CVE-2026-19723: CWE-79 Cross-Site Scripting (XSS) in Social Media Share Buttons & Social Sharing Icons

CVE-2026-19723 is a reflected XSS vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin prior to version 3.0.1. The vulnerability arises from improper escaping of input taken from the incoming request before outputting it in an inline JavaScript event handler. This allows an attacker to inject malicious scripts that execute when a user interacts with the affected social media share button, but only if the plugin is configured with a non-default icon display setting.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the affected website, potentially allowing an attacker to steal user credentials, perform actions on behalf of the user, or conduct other malicious activities. The CVSS score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates or patches addressing this vulnerability. Until a fix is available, avoid using non-default icon display configurations or disable the plugin if possible to reduce exposure.