WordPress security by component
Hubbub Lite
Plugin description
Hubbub Lite is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Jul 23, 2026; the highest CVE/CNA score is 7.5.
Plugin slug:
social-pugLatest vulnerability
CVE-2026-27403: Hubbub Lite: Cross-site scripting
Hubbub Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.36.3.
| Safe version |
|
||
|---|---|---|---|
| Jul 23, 2026 |
CVE-2026-27403
Hubbub Lite: Cross-site scripting
Hubbub Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.36.3.
|
1.36.3.1 |
CVE6.5
NVDPending
|
| Nov 06, 2025 |
CVE-2025-12471
Hubbub Lite – Fast, free social sharing and follow buttons: Cross-site scripting
Hubbub Lite – Fast, free social sharing and follow buttons is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Sep 22, 2025 |
CVE-2025-58007
Hubbub Lite: A security weakness
Hubbub Lite is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| May 15, 2025 |
CVE-2024-10145
Hubbub Lite: Cross-site scripting
Hubbub Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| Dec 09, 2024 |
CVE-2023-49193
Hubbub Lite: A security weakness
Hubbub Lite is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Apr 09, 2024 |
CVE-2024-2501
Hubbub Lite – Fast, Reliable Social Sharing Buttons: Code execution
Hubbub Lite – Fast, Reliable Social Sharing Buttons is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Apr 01, 2024 |
CVE-2024-1526
Hubbub Lite: A security weakness
Hubbub Lite is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 09, 2019 |
CVE-2016-10736
Social Pug: Cross-site scripting
Social Pug is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|