What is the CVSS score of CVE-2026-5425?

CVE-2026-5425 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-5425?

Widgets for Social Photo Feed WordPress plugin versions 1.7.9 and earlier contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-5425?

Within 24 hours: Inventory all WordPress installations and identify sites using Widgets for Social Photo Feed; disable or remove the plugin if not actively required. Within 7 days: Upgrade to version 1.8 or later on all affected installations, or migrate to an alternative social feed solution. Within 30 days: Conduct a security audit of widget configuration data for signs of malicious scripts; review access logs for suspicious widget creation/modification activity during the period the plugin was active.

WordPress CVE-2026-5425

EUVD-2026-18989 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 04, 2026 - 08:45 euvd

EUVD-2026-18989

Analysis Generated

Apr 04, 2026 - 08:45 vuln.today

CVE Published

Apr 04, 2026 - 08:25 nvd

HIGH 7.2

DescriptionCVE.org

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting (XSS) in the Widgets for Social Photo Feed WordPress plugin (versions ≤1.7.9) allows unauthenticated remote attackers to inject malicious scripts via unsanitized 'feed_data' parameter keys, achieving persistent code execution in victim browsers with scope change impact. The vulnerability stems from insufficient input validation on widget configuration data. CVSS 7.2 reflects network-accessible, low-complexity exploitation requiring no privileges or user interaction, w

Technical ContextAI

This vulnerability affects the Widgets for Social Photo Feed plugin (CPE: cpe:2.3:a:trustindex:widgets_for_social_photo_feed) developed by TrustIndex for WordPress content management systems. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the root cause category for cross-site scripting vulnerabilities. The technical issue resides in how the plugin processes the 'feed_data' parameter keys during widget configuration or rendering. WordPress plugins typically store widget configuration in the database through the WordPress options API or widget instance data. The vulnerable code path fails to apply proper sanitization functions (such as esc_html, esc_attr, or wp_kses) when handling feed_data array keys before output to HTML context. When these unsanitized keys are later rendered in administrative dashboards or public-facing pages, embedded JavaScript executes in the security context of the WordPress site. The WordPress.org changeset references point to specific code modifications in trustindex-feed-plugin.class.php and social-photo-feed-widget.php between versions 1.7.8 and 1.8, indicating where sanitization logic was added to neutralize script injection vectors in the feed data processing pipeline.

RemediationAI

WordPress site administrators must immediately upgrade the Widgets for Social Photo Feed plugin to version 1.8 or later, which contains input sanitization fixes for the feed_data parameter vulnerability as documented in WordPress.org changeset 3486529. The specific code changes implementing proper output escaping can be reviewed in the plugin repository changesets at https://plugins.trac.wordpress.org/changeset?old_path=social-photo-feed-widget/tags/1.7.8/trustindex-feed-plugin.class.php&new_path=social-photo-feed-widget/tags/1.8/trustindex-feed-plugin.class.php&old=3440215&new=3486529 and the corresponding social-photo-feed-widget.php modifications. Updates can be applied through the WordPress admin dashboard under Plugins > Updates, or manually by downloading version 1.8+ from the official WordPress plugin repository and uploading via FTP. If immediate patching is not feasible, temporary risk reduction measures include disabling the Widgets for Social Photo Feed plugin entirely until upgrade completion, restricting widget configuration access to only super-administrator roles through WordPress user capability controls, and implementing web application firewall rules to filter requests containing script tags in feed_data parameters. Organizations should also review WordPress database tables (particularly wp_options for widget configurations) for evidence of injected script payloads as part of incident response procedures, though no automated scanning guidance is provided in the vendor advisory.