Super Socializer EUVD-2026-53974

No authentication is required (PR:N) - an unauthenticated remote attacker can deliver the XSS payload. The victim must interact with the crafted content (UI:R), meaning the attack requires a user to visit or click a specially crafted URL or page element. No non-default configuration or specific plugin feature flag is described as a prerequisite; the vulnerability appears to exist in the plugin's standard social interaction functionality available in default deployments. The primary limiting factor is the required user interaction: fully automated, mass exploitation without a social engineering component is constrained. Additionally, exploitation is limited to sites running WordPress with Super Socializer plugin version 7.14.5 or earlier actively installed and enabled.

The NVD CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a meaningful risk profile: network-accessible, low complexity, and requiring no authentication are factors that raise real-world exploitability. The S:C (scope change) component is significant for XSS - it means the injected payload can affect browser context beyond the plugin's own page, amplifying the impact. However, UI:R (user interaction required) is a limiting factor; exploitation cannot be fully automated without social engineering to lure victims. No EPSS score was provided in the source data, and there is no KEV listing, so widespread or automated exploitation is not confirmed. The A:L (availability impact) component in the vendor-provided vector is unusual for a pure XSS vulnerability and may reflect the ability to inject disruptive content rather than causing direct server-side denial of service - this should be verified against the vendor advisory.

An attacker identifies a WordPress site running Super Socializer 7.14.5 or earlier and crafts a URL or input payload containing malicious JavaScript targeting one of the plugin's social interaction inputs. The attacker distributes this link via phishing email or embeds it in a forum post; when an authenticated site visitor clicks the link and the page renders, the injected script executes in the victim's browser, exfiltrating their session cookie to an attacker-controlled server and enabling session hijacking. No public proof-of-concept code has been confirmed, but the unauthenticated, low-complexity nature of the flaw means it is straightforward to reproduce from the CWE-79 vulnerability class.