Reflected Cross-Site Scripting in WordPress Social Media Share Plugin
CVE-2026-89047

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Social Media Share Buttons & Social Sharing Icons
Vendor
CVE Published:
1 October 2026

What is CVE-2026-89047?

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit reflected cross-site scripting (XSS) via specially crafted URLs. This issue arises from insufficient input sanitization and output escaping, enabling attackers to inject arbitrary web scripts. Users on mobile devices, specifically when interacting with the WeChat share icon, are particularly at risk. Once the share dialog opens, the injected script executes automatically, compromising user security without additional user actions.

Affected Version(s)

Social Media Share Buttons & Social Sharing Icons 0 <= 3.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ultimate-socia...
https://plugins.trac.wordpress.org/browser/ultimate-socia...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhamad Visat
.