CVE-2026-105259mediumCWE-79

CVE-2026-105259: medium-severity vulnerability in Easy Social Icons

Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

Published · Updated

Follow this CVE+ Monitor Easy Social Icons

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.2%
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Easy Social Icons
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Easy Social Icons

In the same product, most dangerous first.

CVE-2022-0887—Easy Social Icons < 3.1.4 - Admin+ SQL InjectionEPSS 1.3%CVE-2022-0840—Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add iconEPSS 0.6%CVE-2025-15701LOWEasy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color SettingsEPSS 0.1%