WP Socio WP Telegram Widget and Join Link plugin allows an attacker to inject malicious JavaScript via unsanitized user input, enabling reflected XSS. The flaw lets the attacker embed arbitrary scripts that execute in the browser of any user who visits a crafted page. This can lead to defacement of the site, theft of session cookies, or other client‑side compromise.

WP Socio WP Telegram Widget and Join Link plugin is impacted on all installations running version 2.2.13 or earlier. No other versions are affected.

The vulnerability carries a CVSS score of 7.1. The attack requires a malicious URL or form submission that an unsuspecting user clicks or submits. Because the input is reflected in the response without escaping, a successful exploit is straightforward for an attacker with minimal skill. The CVSS score reflects that an attacker can gain both confidentiality and integrity through persistent client‑side code execution. The EPSS score is not available, and the issue is not listed in the KEV catalog.