The Hubbub Lite – Fast, free social sharing and follow buttons WordPress plugin is vulnerable to reflected XSS via the 'dpsp_list_attention_search' parameter due to insufficient input sanitization and output escaping. This vulnerability affects all versions up to and including 1.36.0. An attacker can craft a URL containing malicious scripts that execute in the context of a victim's browser if the victim clicks the link, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session when the victim interacts with a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links involving the affected parameter and consider disabling or replacing the plugin if possible. Monitor the vendor's communications for updates regarding patches or official mitigations.