The Social Share Buttons plugin for WordPress is susceptible to user-supplied input being stored without proper sanitization or encoding, allowing attackers with subscriber-level or higher authority to inject arbitrary JavaScript that is subsequently rendered whenever users load affected pages. This stored cross‑site scripting flaw can enable session hijacking, defacement, or the injection of malicious content that may spread to other parts of the site or to connected third‑party services.

The vulnerability applies to the maxfoundry Social Share Buttons plugin for WordPress, affecting all releases up to and including version 1.30. Any site running this plugin that grants subscriber or higher roles the ability to edit network settings or share URLs is potentially exposed.

The CVSS score of 6.4 places this bug in the medium severity range, and it is not currently listed in CISA’s KEV catalog. Exploitation requires an authenticated subscriber or higher user to have accessed the wp-admin area for at least seven days to trigger the review‑nag timer, after which the nonce required to reach the save‑network handler is present in the DOM. Once that condition is met, the attacker can submit malicious content that will be stored and executed on subsequent page loads by any visitor, making the risk especially high on multi‑user or high‑traffic sites.