The WP Social Widget plugin contains an improper neutralization of input during web page generation, which allows an attacker to store malicious JavaScript. When a user views content rendered by the plugin, the injected script runs in their browser, potentially exposing session cookies, defacing pages, or redirecting to malicious sites. This stored XSS flaw compromises confidentiality, integrity, and availability of the user experience for anyone who visits affected pages.

The vulnerability affects the WordPress plugin WP Social Widget from the vendor catchsquare. Any installation of the plugin with version numbers up to and including 2.3 is impacted. No specific WordPress core or other component versions are referenced; the issue resides solely within the plugin itself.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can submit content via the plugin’s administrative interface so that the script is stored in the database. Once stored, any viewer of the rendered page will have the script executed in their browser. In environments where the plugin is used publicly or with high traffic, the impact could be amplified.