CVE-2026-103369 Overview
CVE-2026-103369 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Social Share Buttons & Analytics Plugin – GetSocial.io for WordPress. The flaw affects all versions up to and including 4.5. The plugin fails to sanitize input and escape output for the response parameter. Authenticated users with subscriber-level privileges or higher can inject arbitrary JavaScript into the gs-alert-msg, gs-alert-utm, and gs-alert-cta WordPress options. The payload executes in an administrator's browser when the GetSocial settings page loads.
Critical Impact
A low-privileged subscriber account can plant persistent JavaScript that executes in an administrator session, enabling account takeover, privilege escalation, and arbitrary WordPress configuration changes.
Affected Products
- Social Share Buttons & Analytics Plugin – GetSocial.io for WordPress
- All versions up to and including 4.5
- WordPress sites allowing subscriber-level registration
Discovery Timeline
- 2026-10-14 - CVE-2026-103369 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-103369
Vulnerability Analysis
The vulnerability is a stored XSS flaw triggered through the response parameter processed by the plugin's AJAX handler. Attacker-supplied values pass directly into WordPress options storage without sanitization. When an administrator opens the plugin's settings or alert display, the stored values render inside the DOM without output escaping. This produces script execution in the privileged administrator context. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Root Cause
The plugin writes the response parameter into the gs-alert-msg, gs-alert-utm, and gs-alert-cta options using WordPress option APIs without calling sanitization functions such as sanitize_text_field() or wp_kses(). The template rendering code at tmpl/alerts.php echoes the stored values without esc_html() or esc_attr(). Both the ingestion path in lib/gs.php and the rendering path lack the security controls required for authenticated user input.
Attack Vector
An attacker needs a valid subscriber account on the target WordPress site. The attacker sends a crafted AJAX request containing a JavaScript payload in the response parameter. The payload persists in the WordPress options table. When any administrator subsequently loads the GetSocial settings page, the payload executes with administrator privileges in the browser. This enables session theft, creation of new administrator accounts, plugin installation, or arbitrary content modification. Technical references include the WordPress Plugin Code Snippet and the WordPress Alert Template Code.
Detection Methods for CVE-2026-103369
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored in the gs-alert-msg, gs-alert-utm, or gs-alert-cta rows of the wp_options table.
- Creation of unexpected administrator accounts shortly after an administrator visited the GetSocial settings page.
- AJAX POST requests from subscriber accounts targeting GetSocial plugin endpoints with suspicious payloads in the response parameter.
- Outbound requests from administrator browser sessions to attacker-controlled domains referenced by the injected script.
Detection Strategies
- Query wp_options for the three affected option names and alert on values containing HTML or script tokens.
- Enable WordPress audit logging for update_option calls targeting GetSocial options and correlate with the originating user role.
- Deploy a Web Application Firewall (WAF) rule to inspect requests to the plugin's AJAX endpoints for XSS signatures in the response parameter.
Monitoring Recommendations
- Monitor administrator session activity for anomalous API calls originating from the WordPress admin interface.
- Review newly registered subscriber accounts and flag any that interact with plugin AJAX endpoints.
- Track changes to the WordPress users table, especially role elevations and new administrator creation.
How to Mitigate CVE-2026-103369
Immediate Actions Required
- Deactivate the Social Share Buttons & Analytics Plugin – GetSocial.io until a patched version is confirmed available.
- Audit and sanitize the gs-alert-msg, gs-alert-utm, and gs-alert-cta option values in the wp_options table.
- Disable open user registration or restrict it to trusted accounts to remove the attacker's precondition.
- Review recent administrator sessions and rotate credentials for any administrator who accessed the GetSocial settings page.
Patch Information
No fixed version is listed in the NVD record at publication. All versions through 4.5 remain vulnerable. Consult the Wordfence Vulnerability Report for current remediation status and vendor updates.
Workarounds
- Remove the plugin from production WordPress installations until a vendor fix is published.
- Enforce the principle of least privilege by denying subscriber registration where it is not required.
- Deploy a WAF with XSS filtering rules that inspect POST bodies targeting the plugin's AJAX endpoints.
- Delete the three affected options via WP-CLI to purge any stored payloads: wp option delete gs-alert-msg gs-alert-utm gs-alert-cta.
# Purge stored XSS payloads and disable the vulnerable plugin
wp plugin deactivate wp-share-buttons-analytics-by-getsocial
wp option delete gs-alert-msg
wp option delete gs-alert-utm
wp option delete gs-alert-cta
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.