{"id":"CVE-2026-105259","kind":"vulnerability","aliases":["CVE-2026-105259"],"related":[],"title":"Easy Social Icons WordPress plugin lets uploaded SVG files run scripts","description":"The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.","summary":"The Easy Social Icons WordPress plugin before 4.0.3 adds SVG to allowed site-wide upload types without sanitising the files. An author-level user can upload an SVG carrying cross-site scripting payloads, and where another installed Easy Social Icons plugin exposes an upload route, an unauthenticated visitor can do the same.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easy-social-icons","package","self-hosted","wordpress"],"not_affected_if":["no-upload-route-exposed","plugin-version-4.0.3-or-later"],"how_to_check":"- Check the installed Easy Social Icons plugin version in the WordPress admin under Plugins; compare against `4.0.3`.\n- Look for any other installed Easy Social Icons plugin and check whether it exposes an upload route to visitors.","fix":"- Easy Social Icons WordPress plugin: move to `4.0.3` or later.","status":"open","published_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:21+00:00","updated_at":"2026-11-05T06:33:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Easy Social Icons WordPress plugin: move to `4.0.3` or later.","reach":"internet","title":"Easy Social Icons WordPress plugin lets uploaded SVG files run scripts","impact":"medium","summary":"The Easy Social Icons WordPress plugin before 4.0.3 adds SVG to allowed site-wide upload types without sanitising the files. An author-level user can upload an SVG carrying cross-site scripting payloads, and where another installed Easy Social Icons plugin exposes an upload route, an unauthenticated visitor can do the same.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","easy-social-icons","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored cross-site scripting runs in visitors' browsers, possibly admin sessions.","analyst_note":"Confirm which Easy Social Icons plugin versions expose the unauthenticated upload route and whether the NVD record lists a CVSS score; source gave no severity.","how_to_check":"- Check the installed Easy Social Icons plugin version in the WordPress admin under Plugins; compare against `4.0.3`.\n- Look for any other installed Easy Social Icons plugin and check whether it exposes an upload route to visitors.\n- unknown for anything beyond the plugin version in the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-4.0.3-or-later","no-upload-route-exposed"],"who_is_affected":"Sites running the Easy Social Icons WordPress plugin before 4.0.3 are exposed, and the risk is higher where another Easy Social Icons plugin accepts uploads from visitors without an account. Sites that do not run this plugin are not affected, and sites where only trusted administrators can upload are at lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000772,"input_tokens":4271,"output_tokens":689,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105259':14A,17A '-2026':13A,16A '4.0.3':34B,85C,132C 'account':148C 'add':35B,93C 'allow':38B,107C 'anoth':65B,124C 'author':50B,111C 'author-level':49B 'carri':57B 'contain':120C 'cross':59B 'cross-sit':58B 'cve':12A,15A 'easi':1A,19B,28B,67B,79C,126C 'easy-social-icon':18B 'expos':71B,133C 'file':9A,47B,90C,98C 'host':25B 'icon':3A,21B,30B,69B,81C,128C 'instal':66B,125C 'issu':142C 'let':6A 'level':51B 'list':96C 'malici':118C 'may':101C 'packag':22B 'payload':62B,122C 'plugin':5A,32B,70B,83C,130C 'role':112C 'rout':74B,136C 'run':10A 'sanitis':45B,88C 'script':11A,61B 'self':24B 'self-host':23B 'site':40B,60B,105C 'site-wid':39B,104C 'social':2A,20B,29B,68B,80C,127C 'svg':8A,36B,56B,89C,119C 'trigger':145C 'type':43B,99C 'unauthent':76B,138C 'upload':7A,42B,54B,73B,103C,116C,135C 'user':52B,108C 'visitor':77B,139C 'wide':41B,106C 'without':44B,146C 'wordpress':4A,26B,31B,82C,129C 'xss':121C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Easy Social Icons WordPress plugin before 4.0.3 are exposed, and the risk is higher where another Easy Social Icons plugin accepts uploads from visitors without an account. Sites that do not run this plugin are not affected, and sites where only trusted administrators can upload are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["easysocialicons","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105259","severity":null,"published_at":"2026-11-05T06:17:06+00:00","modified_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}