CVE-2026-1923 is a stored cross-site scripting vulnerability in the Social Rocket – Social Sharing Plugin for WordPress. It affects all versions up to 1.3.4.2 and is caused by improper neutralization of input in the ‘id’ parameter during web page generation. Authenticated attackers with Subscriber-level privileges or higher can exploit this flaw to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the low level without user interaction.

Successful exploitation allows an authenticated user with Subscriber-level access or above to inject malicious scripts that execute in other users' browsers when they access the injected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed content. There is no direct impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch is currently documented by the vendor. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until a patch is available, restrict Subscriber-level access to trusted users only and consider disabling or replacing the plugin if possible to reduce risk.