CVE-2026-89047

MediumCVSS 6.1/10Last modified Oct 3, 2026

Description

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-890499.9A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts CVE-2026-89056.1The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This CVE-2026-890504.3The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gatewa CVE-2026-890517.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead CVE-2026-890525.9A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across dev CVE-2026-890548.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for CVE-2026-890559.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.CVE-2026-890576.8A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una CVE-2026-890587.4A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in t CVE-2026-890597.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the dec CVE-2026-89066.1The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to m CVE-2026-890607.7A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s Managed