CVE-2026-66623

WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

We have discovered 41,168 live websites that are affected by CVE-2026-66623.

Run a Free Instant Scan



Affected Software

Product  UltimatelySocial
Category Wordpress Plugins
Vulnerable Domains41,168 live websites (100% of UltimatelySocial install base)
Vulnerable Versions
  • from 0 through 2.9.9
Vulnerable Versions Count29 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 24, 2026
  • Updated - Aug 24, 2026

Credits

  • Bonds | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-66623
United States14,796 websites


Germany3,857 websites
France2,961 websites
GB2,166 websites
Netherlands1,743 websites
Italy1,704 websites
Spain984 websites
Canada873 websites
Denmark806 websites
Poland799 websites

Website Distribution by TLD

Number of websites using CVE-2026-66623
.com18,668 websites
.org3,073 websites
.de2,040 websites
.nl1,570 websites
.co.uk1,262 websites
.it1,192 websites
.fr1,116 websites
.net1,004 websites
.ru653 websites
.pl599 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-66623

Top websites that are affected by CVE-2026-66623. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com United States*,***
*****************.com United States*,***
****************.com United States**,***
*******.com United States**,***
**.org United States**,***
***********.com United States**,***
****.org United States**,***
***********.net Turkey**,***
***************.com United States**,***
***.us United States**,***
See full domain list

FAQ

CVE-2026-66623 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in UltimatelySocial
A total of 41,168 websites have been identified as vulnerable to CVE-2026-66623, based on global website indexing conducted by WebTechSurvey.
The UltimatelySocial is affected by the CVE-2026-66623 vulnerability.
UltimatelySocial versions up to and including 2.9.9 are vulnerable to CVE-2026-66623.