CVE-2026-89047: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in inisev Social Media Share Buttons & Social Sharing Icons
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction.
AI Analysis
Technical Summary
CVE-2026-89047 is a reflected cross-site scripting vulnerability in the inisev Social Media Share Buttons & Social Sharing Icons WordPress plugin. Versions up to and including 3.0.1 fail to properly sanitize and escape input from URL parameters, enabling unauthenticated attackers to inject malicious scripts. The attack vector requires the victim to be on a mobile user-agent and to click the WeChat share icon, triggering automatic script execution within the share dialog. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity.
Potential Impact
An attacker can inject and execute arbitrary scripts in the context of the affected website for users on mobile devices who interact with the WeChat share icon. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The vulnerability requires user interaction to initiate the exploit.
Mitigation Recommendations
No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the WeChat share icon or the plugin on mobile platforms to mitigate risk. Monitoring vendor channels for updates is recommended.
CVE-2026-89047: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in inisev Social Media Share Buttons & Social Sharing Icons
Description
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction.
CVSS v3.1
Score 6.1medium
Affected software
inisev
Social Media Share Buttons & Social Sharing Icons
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89047 is a reflected cross-site scripting vulnerability in the inisev Social Media Share Buttons & Social Sharing Icons WordPress plugin. Versions up to and including 3.0.1 fail to properly sanitize and escape input from URL parameters, enabling unauthenticated attackers to inject malicious scripts. The attack vector requires the victim to be on a mobile user-agent and to click the WeChat share icon, triggering automatic script execution within the share dialog. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating medium severity.
Potential Impact
An attacker can inject and execute arbitrary scripts in the context of the affected website for users on mobile devices who interact with the WeChat share icon. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The vulnerability requires user interaction to initiate the exploit.
Mitigation Recommendations
No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the WeChat share icon or the plugin on mobile platforms to mitigate risk. Monitoring vendor channels for updates is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-10T16:45:45.481Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abe749ca43b0b3b89bd1d5a
Added to database: 10/01/2026, 14:56:28 UTC
Last enriched: 10/01/2026, 15:27:42 UTC
Last updated: 10/02/2026, 03:10:15 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.