The vulnerability arises from the plugin’s failure to neutralize user-supplied input before rendering it in the browser. This DOM-based XSS allows an attacker to inject malicious scripts that execute in the browsers of visitors who access the affected page, potentially leading to credential theft, session hijacking, page defacement or arbitrary code execution within the user’s context.

The flaw exists in the Showeblogin Social plugin for WordPress, authored by Suresh Prasad. All installations of the plugin with versions from the earliest release through 7.0 are affected. Administrators should verify the installed plugin version and consider upgrading, replacing or uninstalling the plugin.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to supply a malicious input that is interpreted by the plugin’s JavaScript in the victim’s browser; the most likely attack vector is a crafted link or page that prompts the user to visit, triggering the DOM-based XSS. This flaw relies on the victim’s browser environment and does not require privileged server access.