Fuse Social Icons
Fuse Social Icons has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 5 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 6.4 out of 10. 2022 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 5 issues recorded for Fuse Social Icons has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Fuse Social Icons is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-5226Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Read the full analysisVulnerability Records
Fuse Social Icons
Author
Daniyal Ahmed (a11n)
Fuse Social Icons (formerly Fuse Social Floating Sidebar) is the easiest way to connect your visitors to your social profiles and let them share your content — a floating icon bar, share buttons, a widget, and a Gutenberg block, all from one clean settings screen. Version 6.0 is a complete, from-the-ground-up rebuild: a modern drag-and-drop admin, real social share buttons (new!), a Gutenberg block, and a one-click migrator that carries over every setting from your current install automatically — nothing to reconfigure, nothing lost. Free features Floating social icon bar — Facebook, X (Twitter), Instagram, Threads, YouTube, LinkedIn, Pinterest, Reddit, GitHub, Behance, Flickr, Tumblr, VK, SoundCloud, Stack Overflow, RSS, and Email. Share buttons — let visitors share your posts to Facebook, X, WhatsApp, and more, auto-inserted before your content or dropped in anywhere via shortcode, widget, or block. Round or square icons, adjustable size and spacing, brand or custom colors, a rotate hover animation, and drop shadow. Left or right floating position, with the option to hide on mobile. A ready-to-use widget and Gutenberg block for placing icons anywhere on your site. Custom CSS, GDPR/Do-Not-Track-aware link handling, and full import/export of your settings. Upgrading from an older version? Activating 6.0 detects your existing profile links, colors, and settings automatically and offers a one-click, non-destructive import — you’ll see a short review screen to confirm before anything changes. Go further with Fuse Social Icons Pro Free covers everything most sites need. When you’re ready for more: Custom icons — upload your own image or icon for any link. Per-network colors, more shapes (rounded, outline), and extra hover effects (lift, pulse, shake, flip, bounce, swing). Action-button reveal mode and a tap-to-chat WhatsApp/Telegram bubble. More networks: WhatsApp, Telegram, TikTok, Discord, Snapchat, Twitch, Spotify, Mastodon, Bluesky, and more. Richer share buttons — after-content and floating-sidebar placement, more shapes and styles, live share counts. Display rules to show or hide icons on exactly the pages/posts you choose. Real click & share analytics, right inside your dashboard. See Fuse Social Icons Pro → Why site owners choose Fuse Social Icons Lightweight — no bloated frameworks, just clean, fast-loading code. One settings screen for everything: floating bar, share buttons, widget, and block. Built-in migration means upgrading from the classic version is safe and automatic. Actively maintained, with real support behind it.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C