The vulnerability is a Cross‑Site Request Forgery that allows an attacker to inject malicious scripts into the plugin’s stored content. A compromised user’s browser can submit an unauthenticated or authenticated request that saves attacker‑controlled JavaScript, which later runs for anyone viewing the affected social media links. This gives the attacker a persistent compromise of data integrity and potential credential theft, with full impact for any user who views the saved content.

Jayesh Parejiya’s Social Media Links WordPress plugin, versions 1.0.3 and earlier. The plugin is widely used in WordPress installations.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, so no large-scale exploitation campaigns are known. Attackers would need to craft a CSRF request—typically via a malicious link or embedded form—to submit to the plugin’s settings page. Because the plugin lacks proper CSRF checks, the request is processed and the arbitrary script is stored, leading to stored XSS when other site users view the links.