easy_social_icons vulnerabilities
CVEs whose affected-version data names the easy_social_icons package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-105259Medium· 6.8Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing X…
▾ SunlitEPSS 0.16%via CVEORG
CVE-2025-15701Low· 3.5Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site S…
▾ SunlitEPSS 0.15%via CVEORG