Social Media Shortcodes
Social Media Shortcodes has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Social Media Shortcodes has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Social Media Shortcodes is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-10166Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Social Media Shortcodes
Author
Michael Beckwith
This plugin registers shortcodes for the following websites, social service on the left, format for the shortcode on the right: Service / shortcode version Blogger [blogger] BookHype [bookhype] Colourlovers [colourlovers] DeviantArt [deviantart] Digg [digg] Dribbble [dribbble] Etsy [etsy] Facebook [facebook] Flickr [flickr] Flipboard [flipboard] GitHub [github] Goodreads [goodreads] HackerNews [hackernews] IMDb [imdb] Instagram [instagram] Last.FM [lastfm] LinkedIn [linkedin] Myspace [myspace] Patreon [patreon] Pinterest [pinterest] Reddit [reddit] Slideshare [slideshare] SpaceHey [spacehey] Soundcloud [soundcloud] TikTok [tiktok] Twitch [twitch] Twitter [twitter] Vimeo X [x] Yelp [yelp] YouTube All examples updated for v1.1 Example 1: [twitter name="JoeSomeone" text="some text you want the link to appear as"] results in this on your post/page: <a href="http://www.twitter.com/JoeSomeone" title="JoeSomeone's Twitter profile" class="twitter_smsc">some text you want the link to appear as</a> Example 2: [twitter name="JoeSomeone"] results in this on your post/page. <a href="http://www.twitter.com/JoeSomeone" title="JoeSomeone's Twitter profile" class="twitter_smsc">JoeSomeone (Twitter)</a> Example 3: [twitter name="JoeSomeone" target="_blank"] results in on your post/page.: <a href="http://www.twitter.com/JoeSomeone" title="JoeSomeone's Twitter profile" target="_blank" class="twitter_smsc">JoeSomeone (Twitter)</a> Filters: function example_add_site( $sites ) { $sites['somesite'] = array( 'Some Site', 'http://www.somesite.com/user/' ); //Return the $sites array return $sites; } add_filter( 'smsc_shortcodes', 'example_add_site' ); function example_add_classes( $classes ) { $classes[] = 'someclass'; return $classes; } add_filter( 'smsc_classes', 'example_add_classes' ); function example_change_final_link( $output, $shortcode ) { if ( 'somesite' == $shortcode ) { $output_new = $output . ' <--Awesome profile!'; } return $output_new; } add_filter( 'smsc_final_link', 'example_change_final_link', 10, 2 );
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C