The Html Social share buttons plugin for WordPress stores user‑supplied attributes from the ‘zm_sh_btn’ shortcode without proper sanitization or escaping, allowing an authenticated contributor to embed malicious JavaScript. When the affected page is loaded, the injected script runs in the context of the site, potentially disclosing sensitive data, defacing content, or enabling further attacks on other users. This vulnerability is a classic stored XSS flaw (CWE‑79).

WordPress sites using the Html Social share buttons plugin, versions 2.1.16 and earlier. The issue appears in all releases up to and including 2.1.16, regardless of additional custom settings.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation probability at this time. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers must be authenticated with contributor or higher privileges; they can then persistently inject code that executes whenever any user visits an affected page. Given that the payload is stored, it can remain active until removed, which increases the potential impact if the site is widely visited.