Stored Cross-Site Scripting Vulnerability in Social Share Buttons Plugin for WordPress

CVE-2026-100108

What is CVE-2026-100108?

The Social Share Buttons plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate input sanitization and output escaping in the 'form (containing share_url)' parameter. This vulnerability allows authenticated attackers with subscriber-level access and above to inject malicious web scripts. When these scripts are executed, they affect users accessing the compromised page. Exploitation requires that a specific 7-day period has passed since the attacker's initial wp-admin visit, as the necessary nonce for saving changes is only made available in the DOM after this timer has lapsed.

References