An unauthenticated Reflected Cross-Site Scripting vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin could allow an attacker to execute malicious scripts in a user browser.

This is a Reflected Cross-Site Scripting (CWE-79) vulnerability where unescaped input from an incoming request is reflected into an inline JavaScript event handler. The flaw is triggered when an unauthenticated user interacts with a specifically configured icon button.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's session, which can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information. With a CVSS score of 7.1, this represents a high risk to the confidentiality and integrity of user interactions within the WordPress environment.

Immediate Action: Update the Social Media Share Buttons & Social Sharing Icons plugin to version 3.0.1 or later to implement the necessary input escaping.

Proactive Monitoring: Review web server and application logs for suspicious characters or script tags appearing in URL parameters associated with the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in incoming HTTP requests.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this XSS vulnerability, administrators should prioritize updating the affected plugin immediately. Failure to patch allows for potential account takeover or malicious redirection of site visitors, which could severely impact both site integrity and user trust.