AccessPress Social Icons 1.8.2 accepts icon title values from authenticated users without proper sanitization, allowing a malicious payload to be stored in the plugin data. When an attacker injects a JavaScript payload – for example, an image tag with an onerror handler – and saves the icon, the script will execute whenever the plugin page is rendered. The vulnerability potentially exposes all users who view the plugin interface to arbitrary client‑side code, enabling phishing, credential theft, or other browser‑based attacks.

The affected system is any WordPress site running AccessPress Social Icons version 1.8.2. The plugin is distributed by Accesspressthemes and is installed as a WordPress plugin component. No other versions or products were listed as impacted by this CVE.

The CVSS score of 5.1 classifies the issue as medium severity. Exploit probability is not provided by EPSS, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with permission to edit plugin icon settings; once a malicious title is stored, any user who views the affected page will experience the injected script. Because the effect is client‑side, it does not compromise the server or other users directly, but the risk of social engineering or further compromise is real.