This vulnerability allows an attacker who can contribute to or manage a WordPress site to inject arbitrary JavaScript into the pages that display the All Social Share Options plugin’s 'sc' shortcode. Because the plugin does not sanitize or escape attributes of this shortcode, the attacker’s code runs under the context of any visitor to the affected page, potentially defacing the site, defacing the user experience, or stealing sensitive data from users’ browsers. The weakness corresponds to CWE‑79 (Improper Neutralization of Input During Web Page Generation).

Any WordPress installation that uses the All Social Share Options plugin in versions 1.0 or older is affected. The plugin is provided by codiblog and is listed as "All Social Share Options." No specific minor releases are quoted beyond the upper bound of 1.0.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests that active exploitation is unlikely to be widespread at this time. The vulnerability is not included in the CISA KEV catalog. Exploitation requires that an attacker possess contributor‑level or higher privileges on the target WordPress site to use the ‘sc’ shortcode with malicious attributes. Once the malicious script is stored, any user visiting the affected page will have the code executed in their browser. The path is internal to the site and requires no external triggers, making it straightforward for an authenticated user to inject payloads.