Plugin inspection:

Social Pug – Easy Social Share Buttons

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.


This recommendation applies to version 1.1.2 of this plugin, but the most recent version is 1.34.3. These findings may no longer be correct.


  • Uses APIs to get the number of likes/shares/etc directly from Facebook, Twitter, Google+, Pinterest
  • Uses an HTTP URL for communicating with Pinterest despite the API also working with HTTPS
  • Has a feedback form with no CSRF-protection. But the form only sends emails to

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Failure criteria

  • Lack of proper output escaping

Read more about our failure criteria.