Ultimate Social Media Icons Vulnerabilities

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.9. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

7.2

Affected:

up to 2.9.9

Fixed in:

3.0.0

Disclosed:

Aug 20, 2026

CVE-2026-66623 on NVD →

[en] The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

Affected:

up to 2.9.1

Fixed in:

2.9.1

Disclosed:

May 15, 2025

CVE-2024-10362 on NVD →

[en] Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media & Share Icons: from n/a through 2.8.1.

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Dec 13, 2024

CVE-2023-34009 on NVD →

[en] Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7.

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Dec 13, 2024

CVE-2023-38514 on NVD →

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVSS:

4.4

Affected:

up to 2.9.0

Fixed in:

2.9.1

Disclosed:

Oct 31, 2024

CVE-2024-10362 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1.

Affected:

up to 2.9.2

Fixed in:

2.9.2

Disclosed:

Jul 21, 2024

CVE-2024-37552 on NVD →

The Social Media & Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scri...

CVSS:

4.4

Affected:

up to 2.9.1

Fixed in:

2.9.2

Disclosed:

Jul 6, 2024

CVE-2024-37552 on NVD →

[en] The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

Affected:

up to 2.8.9

Fixed in:

2.8.9

Disclosed:

Apr 17, 2024

CVE-2024-2118 on NVD →

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVSS:

4.4

Affected:

up to 2.8.8

Fixed in:

2.8.9

Disclosed:

Mar 27, 2024

CVE-2024-2118 on NVD →

[en] The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated att...

Affected:

up to 2.8.6

Fixed in:

2.8.6

Disclosed:

Oct 20, 2023

CVE-2023-5602 on NVD →

[en] The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as w...

Affected:

up to 2.8.6

Fixed in:

2.8.6

Disclosed:

Oct 20, 2023

CVE-2023-5070 on NVD →

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well a...

CVSS:

6.5

Affected:

up to 2.8.5

Fixed in:

2.8.6

Disclosed:

Oct 16, 2023

CVE-2023-5070 on NVD →

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attacker...

CVSS:

4.3

Affected:

up to 2.8.5

Fixed in:

2.8.6

Disclosed:

Oct 16, 2023

CVE-2023-5602 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.

Affected:

up to 2.8.4

Fixed in:

2.8.4

Disclosed:

Sep 27, 2023

CVE-2023-41238 on NVD →

The Social Media & Share Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:

6.1

Affected:

up to 2.8.3

Fixed in:

2.8.4

Disclosed:

Aug 29, 2023

CVE-2023-41238 on NVD →

[en] Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permission...

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Jul 28, 2023

CVE-2023-0958 on NVD →

[en] Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attack...

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Jul 28, 2023

CVE-2023-3977 on NVD →

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers t...

CVSS:

4.3

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Jul 27, 2023

CVE-2023-3977 on NVD →

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, su...

CVSS:

4.3

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Jul 27, 2023

CVE-2023-0958 on NVD →

[en] The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Jun 27, 2023

CVE-2023-1166 on NVD →

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level per...

CVSS:

4.4

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Jun 5, 2023

CVE-2023-1166 on NVD →

The Social Media & Share Icons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_installation function in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to install one...

CVSS:

4.3

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Jun 2, 2023

CVE-2023-34009 on NVD →

Update the plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Social Media & Share Icons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed w...

Affected:

up to 1.1.1.12

Fixed in:

1.1.1.12

Disclosed:

May 30, 2023

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wp_ajax_getForm AJAX action in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVSS:

6.1

Affected:

up to 2.1.7

Fixed in:

2.1.9

Disclosed:

Mar 27, 2019

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wp_ajax_getForm AJAX action in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Affected:

up to 2.1.9

Fixed in:

2.1.9

Disclosed:

Mar 27, 2019

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Arbitrary Options Deletion in versions up to, and including, 1.5.1. This is due to missing capability checks on the sfsi_DeleteSkin() function that deletes options based on a user supplied parameter. This makes it possible for a...

CVSS:

5.4

Affected:

up to 1.5.1

Fixed in:

1.5.2

Disclosed:

Jun 28, 2016

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Arbitrary Options Deletion in versions up to, and including, 1.5.1. This is due to missing capability checks on the sfsi_DeleteSkin() function that deletes options based on a user supplied parameter. This makes it possible for a...

Affected:

up to 1.5.2

Fixed in:

1.5.2

Disclosed:

Jun 28, 2016

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress patched unspecified vulnerabilities in version 1.2.2.

CVSS:

7.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Jul 20, 2015

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress patched unspecified vulnerabilities in version 1.2.2.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jul 20, 2015

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions before 1.1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers of low-privilege to inject arbitrary w...

CVSS:

6.4

Affected:

up to 1.1.1.11

Fixed in:

1.1.1.12

Disclosed:

May 30, 2015

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions before 1.1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers of low-privilege to inject arbitrary w...

Affected:

up to 1.1.1.12

Fixed in:

1.1.1.12

Disclosed:

May 30, 2015

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 1.1.1.12

Fixed in:

1.1.1.12

Disclosed:

May 30, 2015

The Social Media Share Buttons &amp; Social Sharing Icons WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.1.1.12

Fixed in:

1.1.1.12

The Social Media Share Buttons &amp; Social Sharing Icons WordPress plugin was affected by a Multiple Issues security vulnerability.

Affected:

up to 2.2.0

Fixed in:

2.2.0

Affected:

up to 2.8.7

Fixed in:

2.8.7

CVE-2024-31435 on NVD →