The vulnerability is an improper neutralization of user input during web page generation that permits arbitrary JavaScript to be injected into the page when a visitor loads it. This reflected XSS flaw can lead to compromise of the visitor’s browser session, defacement of site content, or other malicious activity. Those potential outcomes are inferred from the typical effects of reflected XSS, as the CVE description does not list specific exploitation results.

Mitchell Bundy WP Social Links WordPress plugin versions up to and including 0.3.1 are affected. WordPress sites that have installed these versions are exposed whenever the plugin renders a page.

The CVSS score of 7.1 indicates a moderate‑to‑high risk level, while the EPSS score of less than 1 % suggests that active exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves an attacker crafting a malicious URL or input that triggers the plugin’s reflected XSS; the resulting script then runs in the victim’s browser. This scenario is inferred from the description.