CVE-2026-109702
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can inject malicious scripts that execute in visitors' and admins' browsers when they view pages displaying the plugin. This requires an attacker to submit unneutralized input and relies on a victim browsing to the affected page.
Root cause
The plugin fails to sanitize user input prior to rendering it on the page, leading to stored cross-site scripting.
Affected systems
maxfoundry Social Share Buttons (share-button) plugin through 1.31
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade to a version newer than 1.31 if available, or deactivate and delete the plugin immediately if no patched release exists.
$ wp plugin deactivate share-buttonAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.