The WP Social Widget plugin contains a stored cross‑site scripting flaw that permits an attacker to inject malicious script into a page that is rendered for all site visitors. A compromised page can be used to steal session cookies, deface the site, or redirect users to phishing sites, thereby compromising confidentiality and availability for legitimate users.

WordPress sites that use the catchsquare WP Social Widget plugin, any version through 2.2.7. The vulnerability is present in the plugin itself, not in WordPress core or other components.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of <1% suggests that attacks against this flaw have not yet been observed with high frequency. The flaw is listed as not in the CISA KEV catalog. The likely attack vector requires an attacker to submit malicious input through the plugin’s data entry interface, which is then stored and later served to unsuspecting visitors. Because the attacker’s access is at a web‑application level, exploitation does not need elevated system privileges, but it does require the ability to write data through the plugin’s UI.