The WP Social Widget plugin for WordPress contains a stored cross‑site scripting flaw caused by failure to neutralize user‑supplied input during web page generation. The flaw allows an attacker to inject arbitrary JavaScript into the widget settings, which is later rendered to visitors of the site. This can lead to cookie theft, session hijacking, malicious content injection or defacement. The weakness follows CWE‑79.

The vulnerability affects the WP Social Widget plugin from catchsquare, including all releases up to and including version 2.3.1. Any WordPress site that installs or uses these versions and permits users to configure the widget without proper input validation is susceptible.

The CVSS score of 6.5 demonstrates moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Attackers are inferred to need the ability to edit widget configuration—typically requiring administrative or editor privileges—to submit the malicious payload. Once stored, the JavaScript is executed in the browsers of visitors, running with the permissions of the victim’s session.