This vulnerability in Meks Smart Social Widget (versions up to 1.6.4) is classified as CWE-79, involving improper neutralization of input during web page generation that leads to stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of affected users. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected widget, potentially leading to information disclosure, modification of content, or denial of service. However, exploitation requires high privileges and user interaction, limiting the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the widget's administrative functions and carefully validate or sanitize inputs where possible to reduce risk.