The Easy Social Share Buttons plugin contains an improper neutralization of input during web page generation. An attacker can supply malicious payloads that are reflected in the page without adequate sanitization, enabling execution of arbitrary JavaScript when users visit the site. This can lead to credential theft, session hijacking, or distribution of malware, affecting the confidentiality and integrity of users’ data.

WordPress sites installing appscreo Easy Social Share Buttons version lower than 10.7.1 are impacted. No specific WordPress core or theme versions are mentioned, but the vulnerability exists in all installations of the plugin up to the noted release.

The CVSS base score of 7.1 classifies this as High severity. The EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. The attack path is a reflected XSS that requires an attacker to convince a user to click a crafted link or visit a malicious page that includes the plugin’s vulnerable rendering. Once the user’s browser executes the script, the attacker gains the user’s privileges in the WordPress context.