The Reaction Buttons WordPress plugin (versions ≤ 2.1.6) suffers from a stored XSS vulnerability due to improper neutralization of input in admin settings. Authenticated administrators can inject malicious scripts that persist and execute in the context of users viewing the injected pages. This vulnerability only affects multi-site setups or installations with unfiltered_html disabled, limiting its scope. The CVSS 3.1 score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with administrator-level access can inject persistent malicious scripts into pages via the plugin's admin settings. These scripts execute in the browsers of users who visit the affected pages, potentially leading to data theft, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires high privileges, limiting exploitation to trusted users. It only affects multi-site WordPress installations or those with unfiltered_html disabled, reducing the overall attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or replacing the Reaction Buttons plugin in multi-site or unfiltered_html-disabled environments. Monitor official sources for updates and apply patches promptly once available.