CVE-2026-109702

HighCVSS 7.1

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS. This issue affects Social Share Buttons: from n/a through 1.31.

Risk Assessment

An attacker can inject malicious script that executes in the user's browser, potentially leading to session theft or other actions in the victim's context. This may compromise the security of the site and its users.

Recommendation

Update the Social Share Buttons plugin to a version later than 1.31. Consider implementing a Content-Security-Policy header to mitigate XSS impact.

Other vulnerabilities in Social Share Buttons

CVE-2026-100108Medium
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS