The vulnerability is a classic reflected cross‑site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript into pages rendered by the Social Share And Social Locker plugin. An attacker can craft a specially‑crafted URL that, when visited by a user with appropriate privileges, will execute arbitrary scripts in the victim’s browser. This can lead to session hijacking, theft of cookies, and redirection to malicious sites. The weakness is captured by CWE‑79.

The flaw affects the Social Share And Social Locker plugin published by reputeinfosystems, version 1.4.1 and all earlier releases. Any WordPress site using this plugin without an upgrade to a newer, patched version is at risk.

The CVSS score of 7.1 reflects significant impact and a non‑restricted attack vector, while the EPSS score of less than 1 % indicates the exploitability probability is currently low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious link that exploits the unneutralized user input; an attacker does not require authentication to deliver the payload.