The Meks Smart Social Widget plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges on multi-site WordPress installations or installations where unfiltered_html is disabled can inject arbitrary scripts via the widget. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.6.3. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges.

An attacker with administrator-level access on affected WordPress multi-site installations or sites with unfiltered_html disabled can inject persistent malicious scripts. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only, and consider disabling or removing the Meks Smart Social Widget plugin on multi-site installations or where unfiltered_html is disabled. Monitor official vendor channels for updates and patches.