Social Media Share Buttons & Social Sharing Icons — Contributor+ Stored XSS via Post Title

The plugin fails to escape the post title before outputting it inside an inline JavaScript event handler, allowing users with the Contributor role or above to inject Stored XSS that triggers when a visitor interacts with the affected share button. Exploitation requires a non-default icon display configuration.

A low-privileged authenticated user (Contributor+) can plant malicious script in a post title that executes in the browser of any visitor or higher-privileged user (editor/admin) who views the affected share button - enabling privilege escalation via session hijacking, admin account takeover, or backdoor injection if triggered by an administrator.