---
id: "CVE-2026-105259"
kind: "vulnerability"
aliases: ["CVE-2026-105259"]
title: "Easy Social Icons WordPress plugin lets uploaded SVG files run scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["easy-social-icons", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-upload-route-exposed", "plugin-version-4.0.3-or-later"]
published_at: "2026-11-05T06:17:06+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105259", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# Easy Social Icons WordPress plugin lets uploaded SVG files run scripts

The Easy Social Icons WordPress plugin before 4.0.3 adds SVG to allowed site-wide upload types without sanitising the files. An author-level user can upload an SVG carrying cross-site scripting payloads, and where another installed Easy Social Icons plugin exposes an upload route, an unauthenticated visitor can do the same.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Easy Social Icons plugin version in the WordPress admin under Plugins; compare against `4.0.3`.
- Look for any other installed Easy Social Icons plugin and check whether it exposes an upload route to visitors.

## Fix

- Easy Social Icons WordPress plugin: move to `4.0.3` or later.

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105259

## From the sources

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_