XSS Vulnerability in Easy Social Icons WordPress Plugin
CVE-2026-105259
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2026
Badges
What is CVE-2026-105259?
The Easy Social Icons plugin for WordPress, prior to version 4.0.3, has a vulnerability that allows users with Author permissions and above to upload malicious SVG files. This issue arises because the plugin does not properly sanitize SVG files, which leads to the potential injection of XSS payloads. Moreover, if another instance of the Easy Social Icons plugin exposed an upload route to unauthenticated users, an attacker could exploit this vulnerability even without an account, posing significant risks to affected WordPress sites.
Affected Version(s)
Easy Social Icons 0 < 4.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.