An attacker can inject malicious scripts into the web page by exploiting the Social2Blog plugin's failure to properly neutralize user input. The plugin reflects the supplied data directly back to the browser, so any embedded script will execute in the victim’s session. This can lead to session hijacking, cookie theft, or website defacement. The flaw is a classic CWE-79 reflected XSS.

The vulnerability exists in the xkollsoftware Social2Blog plugin for WordPress, affecting all releases from the initial build through version 0.2.990. Users of this plugin on any WordPress installation are at risk until the plugin is updated beyond 0.2.990.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The issue is not listed in CISA KEV. The most likely attack vector involves an attacker crafting a URL or form that prompts a user to visit a maliciously constructed page, causing the injected script to run in the user's browser.