The WP Social SEO Booster plugin contains a stored cross‑site scripting vulnerability that fails to properly neutralize user input before rendering it in web pages. The plugin accepts arbitrary text that can be displayed to visitors; an attacker who can inject data into any of its input fields can store malicious scripts that will execute in the browsers of all users who view pages rendered by the plugin. This flaw corresponds to CWE–79, where unsafe output is used to deliver malicious code.

The vulnerability impacts every WordPress site that has installed Daniel’s WP Social SEO Booster – Knowledge Graph Social Signals SEO plugin with a version of 1.2.0 or earlier. All installations using those versions are potentially compromised, regardless of the site’s size or user base.

The CVSS base score of 6.5 marks the vulnerability as medium severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. An attacker needs access to an account that can submit or modify content processed by the plugin; once the malicious payload is stored, it will run in the browsers of visitors to the affected pages.