The Social Media Share Buttons & Social Sharing Icons WordPress plugin before version 3.0.1 fails to escape a value that is taken from the incoming request before outputting it in an inline JavaScript event handler, leading to a reflected Cross‑Site Scripting vulnerability triggered when a user clicks the affected button. Based on the description, the attacker can inject arbitrary scripts, which could hijack sessions, deface the site, or steal credentials from visitors. Because the vulnerability is reflected in user‑controlled input, it could be exploited with a simple crafted URL and does not require authentication. The impact is limited to the browser session of the victim but can affect many users if the site is widely visited.

The affected product is the Social Media Share Buttons & Social Sharing Icons WordPress plugin, with all releases prior to 3.0.1. No specific vendor is listed beyond the plugin name; upgrading to 3.0.1 or later removes the issue.

The vulnerability is a reflected XSS that does not require user authentication but does need the plugin to be configured with a non‑default icon display. An attacker can craft a URL embedding malicious JavaScript and inject it into the inline event handler; a visitor who clicks the affected button will execute the payload in their browser session. Because the code injection is reflected, a wide audience could be impacted if the page is publicly reachable, but the damage is confined to the victim’s browser context and can be mitigated by using the browser’s same‑origin policy. The CVSS score of 7.1 reflects a high severity reflected XSS; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation cannot be quantified precisely; however, reflected XSS is traditionally considered high risk for any site that accepts user input unescaped.