CVE-2026-11798 is a reflected cross-site scripting vulnerability in the Social Share, Social Login and Social Comments Plugin – Super Socializer for WordPress. The issue is due to improper neutralization of input during web page generation, specifically via the 'heateor_mastodon_share' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if they are tricked into clicking a crafted link. The vulnerability affects all versions up to and including 7.14.5. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure and limited integrity impact. There is no direct availability impact. The vulnerability requires user interaction (clicking a crafted link) and does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links involving the 'heateor_mastodon_share' parameter. Monitor the vendor's communications for updates and apply patches promptly once released.