The Floating Social Bar plugin contains an improper neutralization of input during web page generation, allowing an attacker to store malicious script code within the plugin’s data fields. A stored cross‑site scripting vulnerability means that once the payload is submitted, every user who visits the affected page will execute the script in their browser. This can lead to session hijacking, cookie theft, defacement, or the delivery of additional malware to clients.

The vulnerability affects the Syed Balkhi Floating Social Bar plugin for WordPress. All releases up to and including version 1.1.7 are impacted; no affected versions are listed beyond that.

The CVSS score of 5.9 indicates a moderate severity for a stored XSS. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible, and the vulnerability is not listed in CISA’s KEV catalog. Attackers typically need administrative access to the site or a trusted user account to inject the payload, after which the malicious script runs for any visitor to the site.