Share This Image
share-this-image · plugin
Known security vulnerabilities for Share This Image. Find out in seconds which version runs on your site with WP Lens.
9 known vulnerabilities
7 exploitable without logging in · latest Apr 29, 2026
Listed on wordpress.org · latest 2.16 · last updated Aug 13, 2026 · 1K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 7.1
CVE-2024-47326unauthenticated · needs a click≤ 2.01
WordPress Share This Image plugin <= 2.01 - Reflected Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-8761unauthenticated≤ 2.03
Share This Image <= 2.03 - Open Redirect via link Parameter
- Medium 6.1
CVE-2017-18015unauthenticated · needs a click
The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.
- Medium 5.4
CVE-2026-42641unauthenticated≤ 2.14
WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability
- Medium 5.4
CVE-2024-8363contributor+≤ 2.02
Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode
- Medium 5.4
CVE-2024-8108contributor+≤ 2.01
Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter
- Medium 5.3
CVE-2026-39563unauthenticated≤ 2.12
WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability
- Medium 5.3
CVE-2026-25010unauthenticated≤ 2.09
WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability
- Medium 4.7
CVE-2024-33930unauthenticated · needs a click≤ 1.97
WordPress Share This Image plugin <= 1.97 - Open Redirection vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).