Stored Cross-Site Scripting Vulnerability in Html Social Share Buttons Plugin for WordPress

CVE-2025-9849

What is CVE-2025-9849?

The Html Social Share Buttons plugin for WordPress exposes a vulnerability through the 'zm_sh_btn' shortcode, allowing authenticated users with contributor-level access or higher to exploit weaknesses in input sanitization and output escaping. This flaw enables the injection of arbitrary web scripts, which can execute whenever a user accesses a compromised page, increasing the risk of data theft and malicious attacks.

References