Threat database

CVE-2026-42697 is a reflected cross-site scripting (XSS) vulnerability in the Inisev Social Share Icons & Social Share Buttons plugin (ultimate-social-media-plus). This vulnerability affects versions from initial releases up to 3.7.5. It allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 according to CVSS 3.1.

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.

The Social Media Share Buttons & Social Sharing Icons WordPress plugin up to version 3.0.1 is vulnerable to reflected cross-site scripting (XSS) via URL parameters. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user accesses a crafted page and clicks the WeChat share icon on a mobile device. The vulnerability arises from insufficient input sanitization and output escaping.

CVE-2026-66623 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability affecting Inisev's Social Media & Share Icons plugin versions up to and including 2.9.9. This vulnerability allows an attacker to inject malicious scripts during web page generation due to improper input neutralization. The flaw requires no privileges but user interaction is needed to trigger the vulnerability.

The Backup Migration plugin for WordPress contains a command injection vulnerability in all versions up to and including 2.1.5.1. This flaw arises from improper sanitization of the 'file' POST parameter in the restoreBackup() AJAX handler, allowing authenticated users with administrator or equivalent privileges to execute arbitrary OS commands as the web-server user. This vulnerability bypasses WordPress hardening constants that normally restrict code execution from the admin UI. It is a partial regression of a previous vulnerability (CVE-2023-7002) where similar mitigations were not applied consistently.

: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.

CVE-2026-39480 is a high-severity vulnerability in Inisev Backup Migration versions up to and including 2.1.1. It allows unauthenticated attackers to cause sensitive data exposure by inserting sensitive information into sent data. This vulnerability is categorized under CWE-201, which involves the insertion of sensitive information into data sent over a network. No official patch or remediation has been confirmed as of the publication date.

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.

CVE-2025-14944 is a medium severity vulnerability in the BackupBliss – Backup & Migration with Free Cloud Storage WordPress plugin up to version 2.0.0. The issue arises from missing authorization checks and lack of proper nonce verification in the 'initializeOfflineAjax' function. The plugin's endpoint relies on hardcoded tokens exposed in JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing. This can lead to unexpected backup transfers to cloud storage targets and potential resource exhaustion. No official patch or remediation guidance is currently available.

The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1.

Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.