Inisev vulnerabilities
Published CVEs affecting Inisev products: 6 record(s), with severity, exploitation and fixes.
Social Media & Share Icons 2Social Share Icons & Social Share Buttons 1Copy & Delete Posts 1Backup Migration 1BackupBliss – Backup & Migration with Free Cloud Storage 1
CVE-2026-42697
High · 7.1
CWE-79 Oct 10, 2026
WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.
CVE-2026-66623
High · 7.1
CWE-79 Aug 24, 2026
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
CVE-2024-31435
Medium · 4.3
CWE-862 Jun 17, 2026
WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability
: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Social Media & Share Icons: from n/a through 2.8.6.
CVE-2026-39480
High · 7.5
CWE-201 Jun 15, 2026
WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
CVE-2026-53738
High · 8.1
CWE-863 Jun 10, 2026
Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
CVE-2025-14944
Medium · 5.3
CWE-862 Apr 7, 2026
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.