Improper Neutralization of Input During Web Page Generation ('Cross‑Site Scripting') is present in the Inisev Social Share Icons & Social Share Buttons WordPress plugin (versions 3.7.5 and earlier). The vulnerability allows reflected XSS. An attacker who can craft or influence content displayed by the plugin—such as a special URL or form payload—can cause a victim’s browser to execute malicious JavaScript, potentially leading to session hijacking, defacement, or phishing attacks. The flaw matches CWE‑79.

The vulnerability affects the Inisev Social Share Icons & Social Share Buttons WordPress plugin. All releases up to and including version 3.7.5 are impacted. No additional version information is provided, so any installation with a version number 3.7.5 or lower should be considered vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity level. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires no authentication; the attacker merely needs to deliver a crafted request to a page that loads the plugin. Because the flaw is an XSS and the vector is public, it is reasonably exploitable from the web, especially on sites that allow untrusted content input or use the plugin on publicly exposed pages.