The vulnerability allows an attacker to inject malicious script that is persisted in the WordPress Social Share Buttons plugin. When other users load the affected page, the stored script executes, enabling attackers to hijack sessions, store cookies, or deliver malware. The weakness is a classic cross‑site scripting flaw (CWE‑79).

WordPress sites running the maxfoundry Social Share Buttons plugin version 1.31 or earlier are affected. Any site that has not upgraded beyond 1.31 carries the risk.

The CVSS score of 7.1 indicates a medium‑high severity of the flaw. The EPSS score of less than 1% suggests that exploitation attempts are currently infrequent, but the flaw still exists in active deployments. Because the vulnerability is stored XSS, it requires an attacker to first inject the payload—typically by setting configuration or content that the plugin saves and later renders in a page. Once injected, any visitor to the page will execute the script. The flaw is not listed in CISA KEV, but small, easy‑to‑exploit XSS issues are commonly found in the wild and can be leveraged by automated scanners or malicious users who gain write access to the plugin data. Administrators should be alert for anomalous content injections and employ mitigation steps accordingly.