These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-42697 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in Social Share Icons & Social Share Buttons plugin versions up to 3.7.5. Defenders should assess exposure, prioritize remediation, and verify plugin versions.
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-66623 is a high-severity unauthenticated Cross Site Scripting (XSS) vulnerability in the Social Media & Share Icons plugin, version 2.9.9 and possibly earlier. The vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Defenders should assess exposure, prioritize remediation, and verify plugin versions.
The Backup Migration plugin for WordPress has an OS Command Injection vulnerability in all versions up to and including 2.1.5.1. This is due to insufficient sanitization of the `file` POST parameter in the `restoreBackup()` AJAX handler. Authenticated attackers with Administrator-level access can execute arbitrary OS commands as the web-server user.
The CVE-2024-31435 vulnerability is a Missing Authorization issue in the Social Media & Share Icons WordPress plugin, affecting versions up to 2.8.6. This vulnerability allows attackers to exploit incorrectly configured access control security levels. The CVSS score for this vulnerability is 4.3, indicating a Medium severity. The vulnerability was published on June 17, 2026, and last modified on the same day.
CVE-2026-39480 is a HIGH severity vulnerability (CVSS Score: 7.5) in the Backup Migration plugin for WordPress, affecting versions up to and including 2.1.1. This vulnerability allows unauthenticated attackers to access sensitive data. The vulnerability was published on [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-39480) and additional details can be found on [nvd](https://nvd.nist.gov/vuln/detail/ [truncated]
CVE-2026-53738 is a HIGH severity vulnerability in the Copy & Delete Posts plugin for WordPress. The plugin's cdp_action_handling AJAX handler allows any plugin-enabled non-admin role to invoke every operation, including deleting posts and overwriting plugin settings. This is possible due to a lack of per-function capability checks. The vulnerability has a CVSS score of 7.2 and was published on [cvePublis [truncated]
The Backup Migration plugin for WordPress has a Missing Authorization vulnerability in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript.