An input sanitization flaw in the Social Warfare WordPress plugin allows a malicious user to inject script code that is executed in the victim’s browser when a processed page is viewed. This DOM‑based XSS can be used to steal user cookies, deface content, or deliver further phishing payloads, and is catalogued as CWE‑79. The vulnerability is limited to client‑side code execution and does not provide direct server‑side compromise.

WordPress sites that have the WarfarePlugins Social Warfare plugin installed, specifically versions up through and including 4.5.5. Any site that has not upgraded past this version remains exposed to the flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% signals that exploitation is considered unlikely at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted web request that reaches the vulnerable plugin, and the victim must subsequently open a page that renders the unsanitized input – a typical DOM‑based XSS attack vector. No additional prerequisites beyond the vulnerable plugin and active user interaction are reported.