This vulnerability arises from missing or incorrect nonce validation on the Google‑plus‑one‑share‑button admin page. An unauthenticated attacker can craft a forged request that updates the plugin’s settings, injecting malicious scripts that are stored and later executed on the site. The result is a stored cross‑site scripting flaw that can compromise confidentiality, integrity, and availability of the site and its visitors.

The issue affects the WordPress plugin Add Google +1 (Plus one) social share Button distributed by the vendor rohanpawale, specifically all releases up to and including version 1.0.0. WordPress sites that have this plugin installed and have not applied an updated release are exposed.

The severity is moderate with a CVSS score of 6.1, and the EPSS indicates a very low exploitation probability (<1%). Though it is not listed in CISA’s KEV catalog, the flaw allows an attacker to execute a CSRF attack that results in stored XSS, provided they can persuade an administrator to trigger the forged request. The risk is contingent on whether the site’s users interact with the compromised plugin settings page and whether stored scripts are rendered in public pages.