Hubbub Lite – Fast, free social sharing and follow buttons <= 1.36.3.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Descriptions and Top Shared Posts Widget
- ID
- WPSEC-2026-2880
- Plugin
- Hubbub Lite – Fast, free social sharing and follow buttons (social-pug)
- Affected
- all versions before 1.36.3.2
- Remediation
- Update to 1.36.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Hubbub Lite – Fast, free social sharing and follow buttons on WPSec AttackSurface
- Fix released
- Published
Description
The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Sensitive Information Exposure via share button links and the Top Shared Posts widget in all versions up to, and including, 1.36.3.1, due to the dpsp_get_post_description() function and the Top Shared Posts widget not checking post_password_required() before using a post's excerpt or content. This makes it possible for unauthenticated attackers to read the excerpt or the first words of the content of password-protected posts without supplying the password. The text appears in share links such as the LinkedIn summary parameter, and in the widget when excerpts are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2880/
- https://plugins.svn.wordpress.org/social-pug/tags/1.36.3.2/
- https://wordpress.org/plugins/social-pug/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS