The Ocean Social Sharing plugin stores social icon titles without proper sanitization or escaping, allowing an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript. The injected script executes in the context of any visitor who views the affected page, enabling session hijacking, data theft, or defacement. This vulnerability is a classic input‑validation weakness (CWE‑79) that can compromise confidentiality, integrity, and availability for the entire website.

OceanWP Ocean Social Sharing plugin versions up to and including 2.2.1 on WordPress sites. No other vendors or products are affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the near term, and the issue is not listed in the CISA KEV catalog. The most probable attack path involves a contributor editing a social icon title in the WordPress admin interface, which then gets rendered on the front‑end. Patching the plugin removes the storage vector and eliminates the risk.