CVE-2026-103369Published
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-103369 · Microsoft / collected KEV context
cve-program · CVE-2026-103369
- https://www.wordfence.com/threat-intel/vulnerabilities/id/86f9c68f-73ab-4f2b-8424-8515cdf82577?source=cve
- https://plugins.trac.wordpress.org/browser/wp-share-buttons-analytics-by-getsocial/tags/4.5/tmpl/alerts.php#L18
- https://plugins.trac.wordpress.org/browser/wp-share-buttons-analytics-by-getsocial/tags/4.5/wp-share-buttons-analytics-getsocial.php#L54
- https://plugins.trac.wordpress.org/browser/wp-share-buttons-analytics-by-getsocial/tags/4.5/lib/gs.php#L72
- https://plugins.trac.wordpress.org/browser/wp-share-buttons-analytics-by-getsocial/tags/4.5/wp-share-buttons-analytics-getsocial.php#L38
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.