The vulnerability in the Hubbub Lite WordPress plugin allows an attacker to inject arbitrary scripts via the 'dpsp_list_attention_search' parameter. Because the input is not properly sanitized or escaped, any user who follows a crafted link can have malicious JavaScript executed in their browser. This can enable a range of client‑side attacks such as session hijacking, credential theft, or deceptive content injection. The weakness is classified as CWE‑79, a classic reflected XSS flaw.

The flaw affects all installations of the Hubbub Lite – Fast, free social sharing and follow buttons plugin from the nerdpressteam developer, for every release through version 1.36.0 inclusive. WordPress sites that have not upgraded beyond that version are potentially exposed.

The CVSS base score of 6.1 marks this as a moderate‑severity issue. The EPSS score of less than 1% indicates a low probability of widespread exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need only to lure a site visitor to a crafted URL containing the malicious parameter; no authentication or privileged access is required. While the attack surface is limited to user‑initiated actions, the impact on affected users can be significant due to client‑side code execution.