CVE-2026-105259 · Package
NO FIX YET · SEE WHAT TO DO
The Easy Social Icons WordPress plugin before 4.0.3 adds SVG to allowed site-wide upload types without sanitising the files. An author-level user can upload an SVG carrying cross-site scripting payloads, and where another installed Easy Social Icons plugin exposes an upload route, an unauthenticated visitor can do the same.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Easy Social Icons WordPress plugin before 4.0.3 are exposed, and the risk is higher where another Easy Social Icons plugin accepts uploads from visitors without an account. Sites that do not run this plugin are not affected, and sites where only trusted administrators can upload are at lower risk.
Not affected if no-upload-route-exposed, plugin-version-4.0.3-or-later
Who cares easy-social-icons, self-hosted, wordpress
4.0.3.4.0.3 or later.The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.