Atomic Edge analysis of CVE-2026-65544 (metadata-based): The Social Share, Social Login and Social Comments Plugin – Super Socializer, all versions up to and including 7.14.5, contains a stored cross-site scripting (XSS) vulnerability reachable by unauthenticated attackers. The plugin fails to sanitize certain user-supplied input before storing it, and fails to escape it when the content is later rendered. This allows injection of arbitrary web scripts that execute in the context of any user who views the affected page. The CVSS score of 7.2 (high) reflects the network-based attack, low complexity, no privileges, and no user interaction required, with a scope change. No patched version is currently available, and because the plugin is not downloadable from WordPress.org, Atomic Edge research cannot confirm the exact vulnerable code path; conclusions below are inferred from the CWE-79 classification and the vulnerability description.
The root cause is a classic stored XSS condition: the plugin displays user-generated content (such as social share metadata, social login display names, or comments) without applying adequate input sanitization or output escaping. The description identifies insufficient input sanitization and output escaping, which aligns with CWE-79. The vulnerable functionality likely stores an attacker-controlled value in a custom database table, or relies on a WordPress option or user meta field, and later renders it without escaping. Atomic Edge research cannot confirm which specific function or field is vulnerable because no diff or source code is available. However, the pattern is consistent with several Super Socializer features, including the social share counter display, the social login button text, or the social comments area. The lack of authentication requirement further suggests the input originates from an unauthenticated endpoint such as an AJAX action, a public form submission, or a REST API route that the plugin registers for its front-end widgets.
For exploitation, an unauthenticated attacker would submit a crafted request to the vulnerable input vector. Although the exact endpoint is not confirmed, plausible candidates include the WordPress AJAX handler at /wp-admin/admin-ajax.php with a plugin-specific action, or a plugin-registered REST endpoint under /wp-json/super-socializer/. The attacker would include a payload such as `alert(document.cookie)` or an event-handler variant like “ in a parameter that the plugin stores. Because the endpoint does not require authentication and likely does not enforce a nonce, the attacker can send the payload directly. The payload persists in the site’s storage and executes when an administrator or visitor loads a page containing the plugin’s output. Atomic Edge research provides a proof-of-concept script in the accompanying PoC that illustrates the general request pattern, parameterized by configurable target URL and action name.
Because no patched version is available, remediation requires proactively hardening the plugin. The fix must ensure that all user-supplied data is sanitized at the point of entry using appropriate functions, such as sanitize_text_field, sanitize_textarea_field, or sanitize_html, depending on the data type. On output, the plugin must escape all dynamic content using esc_html, esc_attr, or wp_kses, depending on the context. WordPress core functions like the_content and the_title already apply output escaping, but custom output must use the proper escaping functions. Until a patched version is released, website owners should consider disabling the vulnerable features or implementing a virtual patch, such as the ModSecurity rule provided in this research, to block known attack patterns. They should also monitor for any malicious stored content and review any recent posts and user submissions.
Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of any users who view the compromised page, including site administrators. This can lead to session hijacking, theft of administrative cookies, forced actions such as creating new admin users, defacement, and widespread malware distribution. The attack can also access or exfiltrate sensitive data that the logged-in user can see, including private drafts, server environment variables, and other users’ personal information. In a worst-case scenario, an administrator who views the injected page can be coerced into changing their password or unlocking additional functionality, potentially leading to full site compromise and remote code execution. The CVSS scope change indicates the compromised component (the plugin’s output) affects resources beyond its security scope, amplifying the impact.
