Is my WordPress plugin safe?

• Sep 5, 2025Kiwi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58790 · affects up to 2.1.8 · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.

  NVD recordpatchstack.com

• Jul 9, 2024Social Sharing Plugin – Kiwi: Information ExposureCVE-2024-3228 · affects up to 2.1.7 · reported by WordfenceMedium 5.3

  The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.

  NVD recordplugins.trac.wordpress.orgwordfence.com

• Jun 6, 2023Kiwi Social Share: Authorization bypassCVE-2021-4362 · affects 2.1.0 to 2.1.0 · reported by WordfenceCritical 9.8

  The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.

  NVD recordblog.nintechnet.comwordpress.org

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.