CVE-2026-19719 Social Media Share Buttons & Social Sharing Icons CVE debrief

Who should care

Security teams responsible for WordPress installations with the Social Media Share Buttons & Social Sharing Icons plugin, especially those allowing Contributor-level access, should be aware of this vulnerability. They should verify installed plugin versions, inventory affected WordPress installations, and monitor for suspicious Contributor role activity. Additionally, teams should implement Content Security Policy and review compensating controls for exposed systems while remediation is scheduled and verified. This vulnerability requires attention from operators of WordPress installations with the affected plugin, as well as security teams responsible for vulnerability management and incident response. Affected deployments should be identified and prioritized for remediation based on risk and exposure. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability may impact platform security, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls, such as monitoring and detection, should be reviewed for exposed systems while remediation is scheduled and verified. The vulnerability has a medium priority due to the Contributor-level access requirement and limited attack surface. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review. This vulnerability requires a coordinated response from security teams, operators, and vendors to ensure effective remediation and minimize potential impact. The vulnerability affects the Social Media Share Buttons & Social Sharing Icons WordPress plugin, which is used by numerous WordPress installations. The vulnerability has a CVSS score of 6.8 and a MEDIUM severity, indicating a moderate level of risk. Security teams should prioritize remediation based on risk and exposure, and ensure that affected deployments are identified and remediated in a timely manner. The CVE record 6

Technical summary

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks when a visitor interacts with the affected button, requiring a non-default icon display configuration. The vulnerability has a CVSS score of 6.8 and a MEDIUM severity.

Defensive priority

Medium priority due to Contributor-level access requirement and limited attack surface.

Recommended defensive actions

• Verify installed plugin version and compare to 3.0.1
• Inventory affected WordPress installations
• Monitor for suspicious Contributor role activity
• Implement Content Security Policy
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from WPScan indicates a Stored Cross-Site Scripting vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1. Contributor role and above can exploit this vulnerability. Limited evidence suggests that a non-default icon display configuration is required for exploitation. Defenders should verify installed plugin versions, inventory affected WordPress installations, and monitor for suspicious Contributor role activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.