The BeBetter Social Icons plugin (versions up to 2.7) suffers from a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation of this vulnerability could lead to partial compromise of confidentiality, integrity, and availability of the affected application. An attacker could execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious actions. However, exploitation requires user interaction and low privileges, limiting the scope and ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block suspicious input patterns related to this vulnerability may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.