This vulnerability, identified as CWE-79, affects Facebook for WordPress versions <= 5.2.1. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks by injecting malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to execution of malicious scripts in the context of the affected web application, potentially allowing attackers to steal user data, manipulate content, or disrupt service availability to some extent. The CVSS vector indicates partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin and limit exposure by restricting access or disabling the plugin if feasible.