Social Media Widget
Social Media Widget has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2013 and 2024; all 3 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2013 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Externally Controlled Reference To A Resource In Another Sphere, Unrestricted Upload Of File With Dangerous Type.
Every one of the 3 issues recorded for Social Media Widget has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Social Media Widget is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.
CVE-2013-1949Social Media Widget <= 4.0 - Arbitrary File Upload
Read the full analysisVulnerability Records

Social Media Widget
Author
Blink Web Effects
Check out the latest WordPress deals for your site. The Social Media Widget is a simple sidebar widget that allows users to input their social media website profile URLs and other subscription options to show an icon on the sidebar to that social media site and more that open up in a separate browser window. Features Supports the following social media sites: Facebook Google+ Twitter MySpace FriendFeed Orkut Hyves LinkedIn aSmallWorld About.me Skyrock VK Goodreads Github Instagram Flickr Picasa Web Albums Pinterest YouTube Skype Digg Reddit Delicious StumbleUpon Tumblr Buzz Google Talk Vimeo Blogger WordPress Yelp Last.fm Pandora UStream IMDb Hulu Flixter FourSquare Meetup PlanCast SlideShare DeviantArt Cuttings.me Live365 Digital Tunes Soundcloud BandCamp Etsy Better Business Bureau Merchant Circle Ebay Steam RSS E-mail (mailto: or a link to mailing list service) Plus create 6 of your own using a URL to an icon and URL to the service Select from the following icon sizes: 16×16 24×24 32×32 64×64 Custom Select from 4 icon packages: Web 2.0 (Default) – Icons from various artists Sketch – Social Icons Hand Drawn by TheG-Force and Handycons by Janko At Warp Speed Heart – Heart v2 by The Design Superhero Cutout – Icontexto Inside Icons Custom – These will be unaltered via updates. Make sure you follow the same naming scheme as the other icons (facebook.png, twitter.png). You can look at the other icon packs if you are unsure about the naming. See the FAQ for more information on usage. Note that some of the icons in the packs were created and added for this widget by myself. Not all of the requested social media sites were included so I attempted to create icons that mimicked the original artist icons. These are unattributed to myself. I keep attribution to the original artists since it is there design I modified. All icons in this pack are licensed under the Creative Commons license. Note that some of these are non-commercial only. Please go to the sites linked above to get full information on their allowed uses. Choose from multiple animations including: Fade In (you can choose the starting opacity too!) Scale (zoom in) Bounce Combo (All three) Note: Because these are all CSS3 style animations, IE6-7 aren’t supported at all, although IE8 will support Scale. In IE6-8, icons will not be animated and use 100% opacity. Create your own image alt/title tags for hover-over text (i.e. Follow Us On {service}) Choose whether or not to use the rel=”nofollow” tag in your links. (Recommended see http://en.wikipedia.org/wiki/Nofollow) Choose whether or not to open links in a new tab (or browser window). Align your widget left, center, or right. Arrange the order of the icons however you like. Choose to the number of icons per row. Currently you can have one icon per row or auto (maximum # based on the width of the container the widget is placed in). If you like this plugin, please rate it and click “Works” for your WordPress version! Help Please add a post on the WordPress.org support forums with the plugin tagged.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C