Easy Social Icons CVEs and Security Vulnerabilities

CVE-2025-15701

Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Easy Social Icons

CVE-2026-105259

Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed