The Minimal Share Buttons plugin for WordPress contains a stored cross‑site scripting flaw that is triggered by the align parameter. The flaw results from insufficient input validation and output escaping, allowing a user with Contributor or higher privileges to embed arbitrary JavaScript. When a page containing the malicious align value is viewed, the injected script runs in the context of the site visitor, potentially stealing credentials, defacing content or redirecting traffic. The vulnerability directly compromises the integrity and confidentiality of user sessions.

WordPress sites that have the Minimal Share Buttons plugin version 1.7.3 or earlier installed. The affected product is the plugin developed by gonzomir, which was released through the WordPress plugin repository. Users who can edit content as Contributors or higher are able to exploit the flaw.

The CVSS score of 6.4 indicates a medium to high severity for an authenticable vector. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible, especially in targeted attacks. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a logged‑in Contributor or higher user to input a malicious align value through the plugin’s settings or content editing interface; the attacker does not need elevation beyond that role. Once injected, the script executes on all page loads containing the vulnerable element, impacting all visitors to the site.