CVE-2026-100108: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in maxfoundry Social Share Buttons

CVE-2026-100108 describes a stored Cross-Site Scripting vulnerability in the maxfoundry Social Share Buttons WordPress plugin. The flaw exists in all versions up to and including 1.30, where insufficient input sanitization and output escaping of the 'form (containing share_url)' parameter allows authenticated users (subscriber-level or above) to inject arbitrary scripts. The attack requires the 7-day review-nag timer to elapse since the attacker's initial wp-admin visit because the nonce needed to invoke the save-network handler is only present in the DOM after this period.

Successful exploitation allows an authenticated user with subscriber-level privileges or higher to inject persistent malicious scripts into pages. These scripts execute in the context of other users accessing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not allow unauthenticated exploitation and requires a time delay before the attack can be executed.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level user privileges where possible and consider disabling or replacing the Social Share Buttons plugin to prevent exploitation.