CVE-2026-100108
Received Received - Intake

Stored XSS in Social Share Buttons WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-100108
EUVD
EUVD-2026-102817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maxfoundry Social Share Buttons 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Social Share Buttons plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability. This flaw exists due to insufficient input sanitization and output escaping in the 'form (containing share_url)' parameter. Attackers with subscriber-level access or higher can inject malicious scripts into pages. These scripts execute when users visit the compromised page.

Detection Guidance

Check for the Social Share Buttons plugin in WordPress versions up to 1.30. Inspect pages for injected scripts in the 'form' parameter containing 'share_url'. Look for unusual web scripts in pages accessed by users.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. This could lead to unauthorized data access, defacement of websites, or spreading malware. Users with admin privileges are at higher risk of deeper system compromise.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's patient privacy rules. Organizations may face fines, legal action, or reputational damage if user data is compromised through this exploit.

Mitigation Strategies

Update the Social Share Buttons plugin to the latest version. Remove the plugin if unused. Implement input sanitization for user-submitted data. Monitor pages for unauthorized script injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart