Social Media Share Buttons & Social Sharing Icons — Reflected XSS via Pin It Share Handler

The plugin fails to properly escape a value from the incoming request before outputting it inside an inline JavaScript event handler, allowing Reflected XSS when a user interacts with the affected share button. Exploitation requires a non-default icon display configuration.

An attacker can craft a malicious link that, when clicked by a victim on a site running a vulnerable, non-default configuration, executes arbitrary JavaScript in the victim's browser session — enabling session hijacking, credential theft, or other client-side attacks against site visitors or logged-in users.