CVE-2026-19719: CWE-79 Cross-Site Scripting (XSS) in Social Media Share Buttons & Social Sharing Icons

CVE-2026-19719 is a stored cross-site scripting vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin versions prior to 3.0.1. The flaw arises from improper escaping of post titles in inline JavaScript event handlers, allowing users with Contributor or higher privileges to inject malicious scripts. These scripts execute when a visitor interacts with the affected social sharing buttons, potentially leading to full compromise of confidentiality, integrity, and availability of the affected site. Exploitation requires the plugin to be configured with a non-default icon display setting.

Successful exploitation allows an attacker with Contributor or higher privileges to perform stored XSS attacks that execute arbitrary JavaScript in the context of site visitors. This can lead to theft of sensitive information, session hijacking, and potentially full site compromise. The CVSS score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability, but requiring user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 3.0.1 or later once available, as this version presumably fixes the vulnerability. Until then, restricting Contributor role privileges or reverting to default icon display configurations may reduce risk.