The vulnerability permits an attacker to insert malicious scripts that are stored by the Kiwi Social Share plugin and subsequently served to the site’s visitors. Because user‑supplied content is not properly neutralized, scripts injected through the plugin’s input fields can persist and execute whenever the page is viewed. This stored XSS can lead to session hijacking, defacement, or data exfiltration for any user who accesses the affected content.

WordPress sites that use the WPKube Kiwi Social Share plugin, versions up to and including 2.1.8. Administrators should verify the installed plugin version and determine whether an upgrade to a newer release is possible.

The CVSS score of 6.5 places the weakness in the medium severity band. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, we infer that the most probable attack vector involves an attacker with sufficient privileges to submit content through the plugin’s interface; the malicious input is then stored in the database and rendered on the page for other visitors. Mitigating the risk requires applying a patch or disabling the vulnerable plugin.