The catchsquare WP Social Widget plugin for WordPress versions up to 2.2.7 contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability can be exploited by an attacker with low privileges who can trick a user into interacting with malicious content, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is rated medium with a CVSS score of 6.5, reflecting the need for user interaction and limited privileges required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting plugin usage or applying manual input sanitization if feasible. Monitor vendor channels for updates regarding patches or official mitigations.