CVE-2026-19723 Social Media Share Buttons & Social Sharing Icons CVE debrief

Who should care

Users of the Social Media Share Buttons & Social Sharing Icons WordPress plugin, especially those with non-default icon display configurations, should be aware of this vulnerability and take steps to mitigate it. This includes administrators and security teams responsible for maintaining WordPress installations with this plugin. They should review plugin configurations, apply updates, and monitor for suspicious activity.

Technical summary

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 is vulnerable to Reflected Cross-Site Scripting. The plugin fails to properly escape a value from the incoming request before outputting it in an inline JavaScript event handler. This vulnerability can be triggered when a user interacts with the affected button, and exploitation requires a non-default icon display configuration.

Defensive priority

Apply updates for Social Media Share Buttons & Social Sharing Icons WordPress plugin.

Recommended defensive actions

• Apply updates for Social Media Share Buttons & Social Sharing Icons WordPress plugin.
• Verify plugin configuration to ensure non-default icon display settings are reviewed.
• Monitor plugin for any suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was created based on information from the CVE Program and the National Vulnerability Database (NVD). Limited details are available about the vulnerability. The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration. Defenders should verify plugin configurations and user interactions with the affected button.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.