CVE-2025-6067 Overview
CVE-2025-6067 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress. The flaw affects all versions up to and including 6.6.7. It stems from insufficient input sanitization and output escaping on the data-caption and data-linktext parameters. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected pages.
Critical Impact
Contributor-level users can persist malicious scripts that execute in the browser context of any visitor, including administrators, enabling session theft and administrative account takeover.
Affected Products
- Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress
- All versions up to and including 6.6.7
- WordPress sites permitting Contributor-level registration
Discovery Timeline
- 2025-09-06 - CVE-2025-6067 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6067
Vulnerability Analysis
The vulnerability resides in the plugin's frontend rendering logic. User-supplied values passed through the data-caption and data-linktext shortcode or block parameters are written into DOM attributes without proper escaping. When the plugin's public JavaScript reads and injects these values into the page, attacker-controlled HTML and script content executes in the visitor's browser.
Because the payload is stored in post content and rendered to every viewer, exploitation extends beyond the attacker's session. The CVSS scope change reflects impact on components outside the vulnerable plugin, notably the WordPress admin session context. EPSS data lists the exploitation probability at 0.231% (percentile 13.88).
Root Cause
The root cause is missing sanitization on input and missing escaping on output for the data-caption and data-linktext parameters. The plugin trusts values authored by Contributor-level and higher users, then reflects them into HTML attributes that its client-side script later evaluates. See the affected handler at Easy Social Feed public.js line 81.
Attack Vector
An authenticated user with Contributor privileges inserts the plugin shortcode or block into a draft post and supplies a malicious payload in the data-caption or data-linktext attribute. When an editor previews the draft or an administrator reviews it for publication, the script executes with that user's privileges. Refer to the Wordfence vulnerability report for parameter-level detail.
// No verified proof-of-concept code has been published.
// See the Wordfence advisory and plugin source for parameter-level detail.
Detection Methods for CVE-2025-6067
Indicators of Compromise
- Post or page content containing data-caption or data-linktext attributes with <script>, onerror, onload, or javascript: payloads.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after previewing Contributor drafts.
- New administrator accounts or altered user roles created following a Contributor draft review.
- Unexpected modifications to wp_options such as siteurl or home.
Detection Strategies
- Query the wp_posts table for shortcodes referencing the Easy Social Feed plugin containing suspicious attribute values.
- Enable Content Security Policy (CSP) reporting to surface inline script execution on WordPress admin pages.
- Review web server access logs for POST requests to admin-ajax.php and post.php from Contributor accounts followed by admin session activity.
Monitoring Recommendations
- Audit installed WordPress plugins and confirm the Easy Social Feed version is greater than 6.6.7.
- Alert on role changes, plugin installations, and user creation events performed by administrators.
- Monitor Contributor accounts for anomalous authoring patterns, including repeated use of the plugin's shortcodes.
How to Mitigate CVE-2025-6067
Immediate Actions Required
- Update the Easy Social Feed plugin to a version later than 6.6.7 as soon as the vendor publishes a patched release.
- Restrict the ability to author posts containing the plugin's shortcodes to trusted Editor and Administrator roles.
- Audit existing Contributor and Author accounts and remove unused or unverified users.
- Review recent posts and drafts for injected data-caption and data-linktext payloads.
Patch Information
Consult the Easy Social Feed plugin changelog for the fixed release. Apply the update through the WordPress plugin dashboard or via WP-CLI in a staged environment before production rollout.
Workarounds
- Temporarily deactivate the Easy Social Feed plugin until a patched version is installed.
- Remove the Contributor role from untrusted users, or disable open user registration.
- Deploy a web application firewall rule that blocks HTML event handlers and <script> tags within the data-caption and data-linktext parameters.
# Disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate easy-facebook-likebox
# Disable open registration to limit Contributor account creation
wp option update users_can_register 0
# Confirm default new-user role is not privileged
wp option update default_role subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
