Executive brief
The Widgets for Social Photo Feed plugin for WordPress, which is used to display social media feeds on websites, contains a security flaw that allows attackers to inject malicious scripts. Because the plugin does not properly check data sent to it, an attacker can store harmful code on the website without needing to log in. This code then runs in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'feed_data' parameter keys. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into the database. These scripts are subsequently executed in the context of a user's browser session whenever they visit a page where the malicious feed data is rendered. The issue is present in all versions up to 1.7.9 and was addressed in version 1.8.0.
Affected products
- Trustindex Widgets for Social Photo Feed <= 1.7.9
Timeline
- 2026-04-04: disclosed
- 2026-04-04: advisory
References
- https://plugins.trac.wordpress.org/changeset?old_path=social-photo-feed-widget/tags/1.7.8/social-photo-feed-widget.php&new_path=social-photo-feed-widget/tags/1.8/social-photo-feed-widget.php&old=3440215&new=3486529
- https://plugins.trac.wordpress.org/changeset?old_path=social-photo-feed-widget/tags/1.7.8/trustindex-feed-plugin.class.php&new_path=social-photo-feed-widget/tags/1.8/trustindex-feed-plugin.class.php&old=3440215&new=3486529
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2584097a-8955-41c7-b009-c6502fe8b99b?source=cve