The vulnerability is an unauthenticated cross‑site scripting flaw in the Blog2Social plugin for WordPress. Attacker‑supplied input can be crafted to inject arbitrary JavaScript, which will run in the browser of any visitor to the vulnerable page. This can enable session hijacking, data theft, or defacement, as the attacker can execute code with the privileges of the victim’s user.

It affects the WordPress Blog2Social plugin developed by Adenion. All versions up to and including 8.9.2 are impacted, so any site running one of those releases is susceptible.

The CVSS score of 7.1 indicates a high severity for unauthenticated attackers. The EPSS score is not available and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that any visitor can trigger the flaw by submitting malicious input through a public interface of the plugin, making exploitation straightforward.