Vulnerability in versions of the Social Rocket plugin up through 1.3.5 allows attackers to inject arbitrary JavaScript through a reflected cross‑site scripting flaw. Because the plugin fails to properly neutralize input when generating web pages, an attacker can embed malicious scripts that will execute in the browsers of anyone who visits an affected page. This client‑side XSS can compromise a visitor’s session, steal credentials, or perform other actions under the victim’s browser context. The weakness corresponds to CWE‑79, typical of insufficient input sanitization.

WordPress sites that have the Social Rocket plugin installed at version 1.3.5 or earlier are affected.

The CVSS score of 7.1 reflects a high severity impact. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of widespread exploitation. Based on the description, it is inferred that an attacker can exercise this flaw simply by visiting the affected site, making the attack vector network‑based and requiring no special conditions beyond unauthenticated access.