{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9849", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T14:57:22.769Z", "datePublished": "2025-09-06T01:45:17.964Z", "dateUpdated": "2026-04-08T17:25:03.830Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:03.830Z"}, "affected": [{"vendor": "alimuzzamanalim", "product": "Html Social share buttons", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d11217ec-55a6-4422-9995-4cc1761d430e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/html-social-share-buttons/trunk/html-social-share.php#L304"}, {"url": "https://github.com/alimuzzaman/html-social-share-buttons/blob/a614c9ce5731417edcf01747eacd814c754cc2d4/html-social-share.php#L307"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355844%40html-social-share-buttons&new=3355844%40html-social-share-buttons&sfp_email=&sfph_mail=#file4"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-09-03T04:26:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-05T13:40:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T13:58:05.415211Z", "id": "CVE-2025-9849", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T14:05:46.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T13:58:05.415211Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T13:58:07.985Z"}}], "cna": {"title": "Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "alimuzzamanalim", "product": "Html Social share buttons", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-03T04:26:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-05T13:40:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d11217ec-55a6-4422-9995-4cc1761d430e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/html-social-share-buttons/trunk/html-social-share.php#L304"}, {"url": "https://github.com/alimuzzaman/html-social-share-buttons/blob/a614c9ce5731417edcf01747eacd814c754cc2d4/html-social-share.php#L307"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355844%40html-social-share-buttons&new=3355844%40html-social-share-buttons&sfp_email=&sfph_mail=#file4"}], "descriptions": [{"lang": "en", "value": "The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:03.830Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9849", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:03.830Z", "dateReserved": "2025-09-02T14:57:22.769Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-06T01:45:17.964Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9849", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2025-09-06T02:15:30.767", "references": [{"source": "security@wordfence.com", "url": "https://github.com/alimuzzaman/html-social-share-buttons/blob/a614c9ce5731417edcf01747eacd814c754cc2d4/html-social-share.php#L307"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/html-social-share-buttons/trunk/html-social-share.php#L304"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355844%40html-social-share-buttons&new=3355844%40html-social-share-buttons&sfp_email=&sfph_mail=#file4"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d11217ec-55a6-4422-9995-4cc1761d430e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:43:34.025152+00:00", "value": {"mitigation_remediation": ["Upgrade the Html Social share buttons plugin to the latest version that addresses the XSS flaw", "If an update is not yet available, deactivate the plugin or remove instances of the zm_sh_btn shortcode from content until a fix is applied", "Revoke or limit contributor\u2011level access on the WordPress installation to reduce the window of opportunity for malicious input", "Monitor the site\u2019s content database for unexpected script tags and run periodic XSS scanning tools to detect residual injections"], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting that can be triggered by authenticated contributors and above to run arbitrary scripts on site pages"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Html Social share buttons plugin, versions 2.1.16 and earlier. The issue appears in all releases up to and including 2.1.16, regardless of additional custom settings.", "description_and_impact": "The Html Social share buttons plugin for WordPress stores user\u2011supplied attributes from the \u2018zm_sh_btn\u2019 shortcode without proper sanitization or escaping, allowing an authenticated contributor to embed malicious JavaScript. When the affected page is loaded, the injected script runs in the context of the site, potentially disclosing sensitive data, defacing content, or enabling further attacks on other users. This vulnerability is a classic stored XSS flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation probability at this time. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers must be authenticated with contributor or higher privileges; they can then persistently inject code that executes whenever any user visits an affected page. Given that the payload is stored, it can remain active until removed, which increases the potential impact if the site is widely visited."}}}}, "created": "2025-09-07T15:24:55.850066+00:00", "updated": "2026-04-20T19:45:15.512912+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}