Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-42697

CVE-2026-42697HIGH

Inisev Social Share Icons & Social Share Buttons — WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  L    7.1   .0018    7.1     —

AFFECTED
  Product                                    Versions     Fixed
  Social Share Icons & Social Share Buttons  unspecified  3.7.6

TIMELINE
  Apr 29  Reserved by Patchstack
  Oct 10  Published (CNA: Patchstack)
  Oct 12  PATCH SHIPPED — CVE-2026-42697 (Inisev Social Share Icons & Social Share Buttons). Fixed in Social Share Icons & Social Share Buttons 3.7.6.

CWE-79 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 29, 2026	Reserved	Reserved by Patchstack
October 10, 2026	Published	Published (CNA: Patchstack)
October 12, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-42697 (Inisev Social Share Icons & Social Share Buttons). Fixed in Social Share Icons & Social Share Buttons 3.7.6.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Inisev	Social Share Icons & Social Share Buttons	—	—	3.7.6

Weaknesses

CWE-79

References (1)

https://patchstack.com/database/wordpress/plugin/ultimate-social-media-plus/vulnerability/wordpress-social-share-icons-social-share-buttons-plugin-3-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve

Authoritative record: CVE-2026-42697 at cve.org

Vendors: inisev

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42697 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.