The 'Add Google +1 (Plus one) social share Button' WordPress plugin suffers from a CSRF vulnerability caused by missing or incorrect nonce validation on a specific plugin page. This flaw allows unauthenticated attackers to perform unauthorized actions by convincing an administrator to interact with a crafted request. Exploitation can result in injection of malicious web scripts, impacting confidentiality and integrity of the affected site. The CVSS 3.1 base score is 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope change. There is no evidence of known exploits in the wild or an available patch at this time.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious scripts, compromising the confidentiality and integrity of the affected WordPress site. Availability is not impacted. The attack requires user interaction by an administrator, and no privileges are needed to initiate the attack. The vulnerability affects all versions up to and including 1.0.0 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links and consider disabling or removing the vulnerable plugin to prevent exploitation.