Vulnerability · Published Nov 5, 2026 · Assigned by WPScan
CVE-2026-105259Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload
Unrated
In plain English
A security flaw in Easy Social Icons from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 95.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Easy Social Icons | 0 – before 4.0.3 |
References
- https://wpscan.com/vulnerability/51f5716b-b338-497f-a52a-c76a039e01e8/ exploit, vdb-entry, technical-description