Stored Cross-Site Scripting Vulnerability in GetSocial.io Plugin for WordPress
CVE-2026-103369

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Social Share Buttons & Analytics Plugin – Getsocial.io
Vendor
CVE Published:
14 October 2026

What is CVE-2026-103369?

The GetSocial.io plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'response' parameter due to inadequate input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject malicious scripts that are stored in specific WordPress options. When an affected page is accessed, these scripts execute in the browser of an administrator visiting the GetSocial settings page, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

Social Share Buttons & Analytics Plugin – GetSocial.io 0 <= 4.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-share-butto...
https://plugins.trac.wordpress.org/browser/wp-share-butto...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alz
.