Unescaped Request Values Enable Reflected XSS in WordPress

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the Social Media Share Buttons & Social Sharing Icons WordPress plugin versions before 3.0.1. The plugin fails to properly escape user-supplied input from requests before injecting it into inline JavaScript event handlers, allowing attackers to execute arbitrary JavaScript in victims' browsers. This matters because WordPress plugins are high-value attack targets affecting thousands of websites simultaneously. Any site running the vulnerable plugin with non-default icon display settings is at risk. Attackers can craft malicious URLs that, when clicked by users, execute JavaScript in the context of the WordPress site, potentially stealing session tokens, admin credentials, or redirecting users to phishing pages.

Casky's 323 mapped skills detect the attack patterns behind this vulnerability by analyzing Initial Access (TA0001) and Reconnaissance (TA0043) techniques. When practitioners run queries against their environment, they'll identify indicators such as malicious URL parameters in access logs, suspicious query strings targeting the plugin's icon configuration parameters, and JavaScript payloads in HTTP requests. Claude's extended reasoning correlates these patterns with known XSS payloads and the plugin's vulnerable code paths. Practitioners would see findings highlighting reflected input flows, unescaped variables in event handlers, and attack chains where Social Engineering precedes malicious link delivery. The skill set enables detection of both the vulnerability itself (code analysis) and active exploitation attempts (behavioral detection of XSS probe traffic and payload delivery).

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19723.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-19723

Casky has 323 skills that investigate the attack patterns behind CVE-2026-19723. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn