CVE-2026-7659

Vulnerability

Overview The Advanced Social Media Icons plugin for WordPress is vulnerable to Stored Cross-Site Script Insertion (XSS) in all versions up to and including 1.2. The flaw resides in the social shortcode, where user-supplied attributes are not properly sanitized or escaped before being output. This allows an attacker to inject arbitrary JavaScript or HTML that becomes part of the page content [1].

Exploitation

Conditions An authenticated attacker with at least Contributor-level access can exploit this vulnerability by crafting a malicious shortcode attribute. When the shortcode is rendered on a page, the injected script executes in the context of any user who subsequently visits that page. No additional privileges or network-level access are required beyond the ability to create or edit posts/pages [1].

Impact

Successful exploitation leads to Stored XSS, enabling the attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the site. The injected script persists in the database and executes each time the page is loaded, affecting all visitors [1].

Mitigation

The plugin has been closed as of May 6, 2026, 2026, pending a full review, and is no longer available for download. Users should remove the plugin immediately and consider alternative solutions. No patched version is currently available [1].