The Syed Balkhi Floating Social Bar plugin versions up to 1.1.7 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with high privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to data disclosure, modification, or disruption of service. The impact is limited to confidentiality, integrity, and availability with low severity on each, resulting in an overall medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin to trusted administrators and avoid exposing it to untrusted users. Monitor vendor channels for updates and apply patches promptly once available.