The catchsquare WP Social Widget plugin for WordPress versions up to 2.3.1 contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS attacks, enabling attackers to execute arbitrary scripts in the context of users viewing the affected web pages. This may result in partial disclosure of information, modification of data, or disruption of service. However, exploitation requires the attacker to have low privileges and user interaction, limiting the ease of exploitation and overall impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from catchsquare and apply any official fixes once available. Until then, consider restricting user input that can be rendered by the plugin or disabling the plugin if feasible to reduce exposure.