CVE-2026-42697: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Inisev Social Share Icons & Social Share Buttons

This vulnerability (CVE-2026-42697) is an instance of CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). It affects Inisev's Social Share Icons & Social Share Buttons plugin in versions up to and including 3.7.5. The vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of users' browsers, leading to potential data theft, session hijacking, or other impacts. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of affected systems through execution of arbitrary scripts in users' browsers. This can result in theft of sensitive information, session hijacking, or disruption of service. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting use of the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.