A cross‑site request forgery vulnerability exists in the WordPress Buffer – HYPESocial plugin that can be leveraged to execute reflected cross‑site scripting attacks. The flaw allows an attacker to craft a request that the authenticated user unknowingly submits, resulting in unintended actions or injected script execution within the user’s context.

The vulnerability affects the WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule plugin for all releases up to and including version 2020.1.0. The plugin is distributed by Dejan Markovic.

The CVSS score of 7.1 indicates a high‑severity risk, but the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with a logged‑in session that has permission to use the plugin; the likely attack vector is a web request manipulated by an attacker, though specific details are not provided in the description.