The WP Social Meta plugin for WordPress is impacted by an input sanitization defect that permits an authenticated administrator to embed malicious script content within the plugin’s settings. When a user opens a page that displays those stored settings, the injected code runs in the visitor’s browser, potentially enabling phishing, session hijacking, or other client‑side malicious actions. This flaw corresponds to CWE‑79 and is confined to configurations where the unfiltered_html capability is disabled.

The vulnerability applies to every release of the bulktheme:WP Social Meta WordPress plugin up to and including version 1.0.1. It is confined to WordPress multi‑site installations that have disabled the unfiltered_html feature.

The CVSS base score is 4.4, indicating moderate risk, while the EPSS score is below 1 %, reflecting a very low exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation requires administrator‑level or higher credentials and a multi‑site configuration with the unfiltered_html setting turned off; an attacker can then store arbitrary JavaScript via the plugin’s settings which executes for any user who views the affected page.