The GetSocial.io Social Share Buttons & Analytics Plugin contains a stored cross‑site scripting flaw that enables authenticated users with subscriber-level access or higher to inject arbitrary JavaScript via the ‘response’ parameter. The injected script is saved in WordPress options—gs‑alert‑msg, gs‑alert‑utm, and gs‑alert‑cta—and is executed when an administrator visits the GetSocial settings page. This flaw allows the attacker to run client‑side code in the context of the site’s administrators, potentially compromising the functionality of the admin interface.

WordPress installations that use the Social Share Buttons & Analytics Plugin – GetSocial.io, version 4.5 or earlier, are affected. The vulnerability resides in the plugin’s handling of the gs_update_with_values AJAX request, which is accessible to any authenticated user with subscriber or higher permission.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is below 1 %, reflecting a very low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires valid credentials of an authenticated subscriber‑level or higher user to submit a malicious payload via the AJAX endpoint; once injected, the script executes whenever an administrator opens the plugin settings page, with no additional conditions cited in the disclosure.