The WP Social Ninja plugin, a WordPress add‑on that aggregates content such as Google Reviews and YouTube feeds, contains a stored XSS flaw that lets an unauthenticated user inject arbitrary JavaScript into pages that render imported external content. This vulnerability arises from insufficient sanitization and escaping of content retrieved from external services. An attacker who can post to a connected Google Business Profile or Facebook page could embed JavaScript that will execute whenever a site visitor loads the affected review page. While the vulnerability does not explicitly mention session hijacking or data exfiltration, such outcomes are a typical consequence of XSS and are thus inferred based on the behavior of client‑side code execution.

WordPress sites running the WP Social Ninja plugin by adreastrian, versions up to and including 3.20.3. The flaw affects the review content rendering pathways that display externally sourced data.

The CVSS score of 6.1 classifies the issue as moderate severity, while an EPSS score of less than 1% indicates low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, reflecting a limited known exploitation footprint. The attack requires the ability to post content to an external business profile; once compromised, the injected script executes in the browsers of any visitor who views the compromised review page, giving the attacker client‑side code execution.