WordPress security by component

Social Media & Share Icons

Plugin description

Social Media & Share Icons adds customizable social media icons and sharing buttons to WordPress websites.

Social Media & Share Icons (ultimate-social-media-icons) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Oct 01, 2026; the highest published CVSS base score is 7.1.

Plugin slug: ultimate-social-media-icons

Latest vulnerability

CVE-2026-89047: Social Media Share Buttons & Social Sharing Icons: Cross-site scripting

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction. The authoritative export does not name the request parameter or handler beyond the affected feature described above. The official changelog confirms a matching fix in 3.0.2.

PublishedOct 01, 2026

Known safe version3.0.2

Published vulnerabilities for ultimate-social-media-icons
		Safe version
Oct 01, 2026	CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons: Cross-site scripting The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction. The authoritative export does not name the request parameter or handler beyond the affected feature described above. The official changelog confirms a matching fix in 3.0.2.	3.0.2	CVE6.1 NVDPending
Aug 24, 2026	CVE-2026-66623 Social Media & Share Icons permits unauthenticated cross-site scripting Social Media & Share Icons through 2.9.9 accepts unauthenticated attacker-controlled input that reaches browser output without adequate neutralization. A victim must visit or interact with the affected content for script to execute in the site's origin, allowing access to data and actions available to that browser session.	3.0.0	CVE7.1 NVDPending
Jun 17, 2026	CVE-2024-31435 Social Media & Share Icons: A security weakness Social Media & Share Icons is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.8.6.	2.8.7	CVE4.3 NVDPending
Dec 13, 2024	CVE-2023-34009 Social Media & Share Icons: A security weakness Social Media & Share Icons is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Jul 21, 2024	CVE-2024-37552 Social Media & Share Icons: Cross-site scripting Social Media & Share Icons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD5.4
Sep 27, 2023	CVE-2023-41238 Ultimate Social Media Icons: Cross-site scripting Ultimate Social Media Icons is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers