What this plugin does

• Slug: ultimate-social-media-icons
• Author: Inisev
• 100000+ active installs
• 96/100 rating (5334 reviews on wordpress.org)
• 12440991 all-time downloads
• On WordPress.org since 2014-09-19

shareshare iconssocialsocial mediawidget

Maintenance status

• Latest known version: 2.9.9
• Last updated: 2026-08-25 3:22pm GMT
• Tested up to WordPress: 7.0.4
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

13 known CVEs on file for Ultimate Social Media Icons. Reported between 2015 and 2026.

+ 15 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2023-41238	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.4	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	High 7.1	< 2.8.4	2.8.4	2023-08-29	✓ fixed in latest
CVE-2023-0958, CVE-2023-38514	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Missing Authorization	Medium 6.5	< 2.8.2	2.8.2	2023-07-27	✓ fixed in latest
CVE-2023-3977	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Cross-Site Request Forgery (CSRF)	Medium 4.3	< 2.8.2	2.8.2	2023-07-27	✓ fixed in latest
CVE-2023-1166	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 4.8	< 2.8.2	2.8.2	2023-06-05	✓ fixed in latest
CVE-2023-34009	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Missing Authorization	Medium 4.3	< 2.8.2	2.8.2	2023-06-02	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Unknown	< 1.1.1.12	1.1.1.12	2023-05-30	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.1.9	—	Unknown	< 2.1.9	2.1.9	2019-03-27	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.5.2	—	Unknown	< 1.5.2	1.5.2	2016-06-28	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.2.2	—	Unknown	< 1.2.2	1.2.2	2015-07-20	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Unknown	< 1.1.1.12	1.1.1.12	2015-05-30	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Unknown	< 1.1.1.12	1.1.1.12	2015-05-30	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.2.0	—	Unknown	< 2.2.0	2.2.0	—	✓ fixed in latest
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Unknown	< 1.1.1.12	1.1.1.12	—	✓ fixed in latest
—	Social Media & Share Icons <= 1.1.1.11 - Authenticated Stored Cross-Site Scripting (XSS)	—	Unknown	< 1.1.1.12	1.1.1.12	—	✓ fixed in latest
—	Social Media & Share Icons < 2.2.0 - Multiple Issues	—	Unknown	< 2.2.0	2.2.0	—	✓ fixed in latest

How to fix it

Keep Ultimate Social Media Icons updated — 2.9.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• AddToAny Share Buttons — 300000+ active installs — 94/100 (1113)
• Ocean Social Sharing — 60000+ active installs — 90/100 (11) — max PHP 8.4
• Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds — 40000+ active installs — 96/100 (396) — max PHP 8.4
• Simple Share Buttons Adder — 40000+ active installs — 86/100 (627)
• Genesis Simple Share — 10000+ active installs — 88/100 (33)