CVE-2026-19719

Name of the Vulnerable Software and Affected Versions Social Media Share Buttons & Social Sharing Icons WordPress plugin versions prior to 3.0.1

Description The plugin fails to escape the post title before outputting it within an inline JavaScript event handler. This allows users with the Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks, which are triggered when a visitor interacts with the affected button. This issue occurs when the plugin is configured with a non-default icon display setting.

Recommendations Update the Social Media Share Buttons & Social Sharing Icons WordPress plugin to version 3.0.1 or later.