{
 "id": "WPSEC-2026-2880",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2880/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2880/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2880/index.md",
 "title": "Hubbub Lite – Fast, free social sharing and follow buttons <= 1.36.3.1 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Descriptions and Top Shared Posts Widget",
 "description": "The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Sensitive Information Exposure via share button links and the Top Shared Posts widget in all versions up to, and including, 1.36.3.1, due to the dpsp_get_post_description() function and the Top Shared Posts widget not checking post_password_required() before using a post's excerpt or content. This makes it possible for unauthenticated attackers to read the excerpt or the first words of the content of password-protected posts without supplying the password. The text appears in share links such as the LinkedIn summary parameter, and in the widget when excerpts are enabled.",
 "plugin": {
  "slug": "social-pug",
  "name": "Hubbub Lite – Fast, free social sharing and follow buttons",
  "full_name": "Hubbub Lite – Fast, free social sharing and follow buttons",
  "wordpress_org": "https://wordpress.org/plugins/social-pug/",
  "advisories_url": "https://wpsec.com/vuln/plugin/social-pug/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/social-pug"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.36.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.36.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.36.3.2",
 "remediation": "Update to 1.36.3.2 or later.",
 "fix_released": "2026-11-10T15:40:49+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:08.427516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2880/",
  "https://plugins.svn.wordpress.org/social-pug/tags/1.36.3.2/",
  "https://wordpress.org/plugins/social-pug/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/social-pug",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}