CVE-2026-19723

CVE-2026-19723 is a reflected Cross-Site Scripting (CWE-79) flaw in the Social Media Share Buttons & Social Sharing Icons WordPress plugin, caused by a value taken from the incoming HTTP request being output into an inline JavaScript event handler without proper escaping. An attacker crafts a malicious link containing the unescaped parameter, and the injected script executes when a victim user interacts with the affected button; exploitation additionally requires the site to use a non-default icon display configuration. Successful attacks run attacker-controlled JavaScript in the victim's browser in the context of the affected site, which per the scope-changed CVSS 3.1 score of 7.1 carries low confidentiality and integrity impact. Any WordPress site running a plugin version before 3.0.1 with a non-default icon display configuration is affected; the attack requires no authentication, only user interaction. As of now there is no known public proof of concept, the flaw is not listed in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Update the Social Media Share Buttons & Social Sharing Icons plugin to version 3.0.1 or later. Sites that cannot patch immediately can mitigate by reverting the icon display configuration to the plugin's default, since only non-default configurations are exploitable. With no public PoC known, treat this as a routine patch priority rather than an emergency, but beware crafted links that trigger the reflected payload.