WP Social Widget

WP Social Widget has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (100%).

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, most of them (2) reported by Muhammad Yudha - DJ. WP Social Widget is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all WP Social Widget vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-57981

WP Social Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

5 records


2025-09-22 00:00	WP Social Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Social Widget <= 2.3.1	`CVE-2025-57981`	6.4 Medium	theviper17y	No
2025-06-05 00:00	WP Social Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Social Widget <= 2.3	`CVE-2025-49306`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-03-24 00:00	WP Social Widget <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Social Widget <= 2.2.6	`CVE-2025-30610`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-02-28 00:00	WP Social Widget <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode WP Social Widget <= 2.2.5	`CVE-2024-27189`	6.4 Medium	LVT-tholv2k	Yes
2023-01-06 00:00	WP Social Widget <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode WP Social Widget <= 2.2.3	`CVE-2023-0074`	6.4 Medium	István Márton	Yes

Showing 1–5 of 5 reports

Latestv2.3.1

WP Social Widget

Author

catchsquare

4.7(11)

94/100

Last Updated

2025-05-25 (1y ago)

Active Installs

4,000+

Downloads

123,724

Requires WP

2.8+

Requires PHP

Tested up to

WP 6.7.7

Created

2015-12-10 (11y ago)

WP Social Widget is a plugin which takes a simple, extendable approach to display links along with social icons to your social networking profiles in WordPress You will find following widget with options: Background Color Background Hover Color Icon Color Icon Hover Color Icon to circle Input fields to input your social profile links From ver 2.0.0, we also have added shortcode feature . You can use shortcode => [wpsw] to produce the social icons. Before that you need to assign social link in the shortcode. For example [wpsw background_color = "#ffffff" facebook="your_profile_url"] Here are the parameters of the shortcode given below background_color [default: #ffffff ] background_hover_color [default: #000000 ] icon_color [default: #000000 ] icon_hover_color [default: #ffffff ] target [default: _blank options: same as <a> tag’s target attribute ] icon_circle [default: “no” | options: yes,no ] title facebook twitter behance dribbble flickr foursquare github google instagram linkedin mail pinterest rss skype soundcloud stumbleupon tumblr vimeo vine vk xing yelp youtube

View on WordPress.org