Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Social Share Buttons Subscriptions

Search

Switch to Advanced Search (Beta)
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-109702 2 Maxfoundry, Wordpress-extensions 2 Social Share Buttons, Social Share Buttons 2026-10-24 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
CVE-2026-100108 2 Maxfoundry, Wordpress-extensions 2 Social Share Buttons, Social Share Buttons 2026-10-21 6.4 Medium
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.