The CVE description frames the defect as a Cross‑Site Request Forgery vulnerability that allows an attacker to compel authenticated users to submit data to the Social Links plugin. While the wording explicitly mentions only CSRF, it does not detail whether malicious payloads such as JavaScript can be stored and later rendered. The accepted CWE (352) reflects this request‑validation issue. However, the CVE title identifies the flaw as a stored Cross‑Site Scripting vulnerability, so it is reasonable to infer that the CSRF attack could be leveraged to store malicious scripts that are executed when visitors view the plugin content. Consequently, the impact includes the potential for both unauthorized data manipulation via CSRF and client‑side script execution if the stored data is rendered without proper sanitization.

WordPress sites that have installed the Social Links plugin developed by kareemsultan and whose version is 1.0.11 or earlier. Versions newer than 1.0.11 are not reported as affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a remote CSRF request that injects JavaScript into the plugin, which will then be rendered when the plugin’s content is presented to site visitors.