The vulnerability is a stored cross‑site scripting flaw that permits authenticated users with Contributor role or higher to inject arbitrary JavaScript into pages via the "social" shortcode. Because the plugin does not properly sanitize shortcode attributes or escape output, the malicious payload is stored in the database and executed whenever a visitor loads the affected page. The attacker can steal session cookies, deface content, or redirect users to malicious sites. This weakness is classified as CWE‑79.

WordPress sites that run the Advanced Social Media Icons plugin version 1.2 or earlier. The plugin is distributed by riotweb. Any installation that allows contributors or higher to insert content through the shortcode is affected. No specific WordPress core or PHP version dependencies are listed, so the advisory applies broadly to installations using the impacted plugin.

The CVSS score of 6.4 indicates medium severity. No EPSS score is publicly available, and the vulnerability is not in CISA KEV, implying a lower likelihood of widespread exploitation at present. However, the attack vector requires only that an authenticated user with Contributor privileges inject a payload via the shortcode editor; once in place, the stored XSS affects every visitor of the page. Because the flaw relies on existing editing privileges, the threat is constrained to sites where such roles exist, but the impact can be widespread for those users.