The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in all versions up to and including 3.20.3. This vulnerability is due to insufficient sanitization and escaping of input from external sources such as connected Google Business Profile or Facebook pages. An unauthenticated attacker who can post malicious content to these connected profiles can inject arbitrary web scripts that execute in the context of users visiting the affected WordPress pages. This vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users visiting the affected WordPress site pages that embed content from compromised external profiles. This can lead to partial disclosure of confidential information and integrity impacts such as content manipulation. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider limiting or monitoring the content sourced from connected Google Business Profile or Facebook pages to prevent injection of malicious scripts. Avoid exposing the plugin on high-risk or public-facing sites if possible. Follow vendor channels for updates on patches or official mitigations.