Stored cross-site scripting in Social Share Buttons WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Social Share Buttons plugin for WordPress in all versions up to and including 1.30 does not sufficiently sanitize input or escape output in its network settings form, which is a cross-site scripting flaw (CWE-79). An authenticated attacker with subscriber-level access or higher can store scripts through the share_url setting that run when a user opens an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| maxfoundry | Social Share Buttons | up to 1.30 | — | No fix listed | CNA |
- Social Share Buttons Vendormaxfoundry Affected up to 1.30 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Social Share Buttons.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-100108
- 2026-10-16 Alias added: GHSA-hx89-3mx2-r93w
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc098f5d-3c59-4046-bce8-ac2586e6da19?source=cve
- https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-social-networks.php#L370
- https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/blocks/network-block.php#L47
- https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-network.php#L275
- https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/admin/review_notice.php#L26
- https://plugins.trac.wordpress.org/browser/share-button/tags/1.30/classes/class-social.php#L60
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3735252%40share-button&new=3735252%40share-button
More maxfoundry vulnerabilities
- TI-2024-02833 WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2021-22595 WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset CVSS 4.0MEDIUM 5.1
- TI-2024-09778 MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width CVSS 3.1MEDIUM 4.8
- TI-2024-08328 MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color CVSS 3.1MEDIUM 4.7
- TI-2024-20210 WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2022-20032 WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-100108 · CVE Program
- CVE-2026-100108 · NVD
- FIRST EPSS
- GHSA-hx89-3mx2-r93w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences