The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject malicious JavaScript into web pages served by the Super Socializer plugin. Because the exploit does not require authentication, any visitor to the affected website can trigger the injected script. This can lead to client‑side defacement, credential theft via session hijacking, or loading of additional attacker controlled resources, thereby compromising user confidentiality and potentially enabling further attacks on the host system.

Vendors identified by the CNA include Rajat Varlani’s Super Socializer plugin. All releases of the plugin up to and including version 7.14.5 are affected. No other product versions are listed as impacted.

The CVSS score of 7.1 values this flaw as high severity, meaning that if exploited it could have a substantial impact on the affected site. The EPSS score is not available, so the current exploitation probability cannot be quantified; however, because the attack is unauthenticated and depends only on a web page view, the potential for widespread exploitation is significant. The vulnerability is not listed in the CISA KEV catalog, but the combination of unauthenticated access and client‑side code execution suggests that an attacker could target any site running the affected plugin without additional privileges.