This vulnerability in the Follow Us Badges plugin by DraftPress Team allows stored cross-site scripting due to improper input neutralization during web page generation. It affects versions up to 3.1.11. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and scope change with low impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the plugin is not a cloud service.

Successful exploitation could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to information disclosure, modification, or denial of service. The impact is rated medium based on the CVSS score of 6.5. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit user privileges to trusted users only and avoid interacting with untrusted content in the affected plugin. Monitor official DraftPress Team communications for updates on patches or mitigations.