CVE-2026-5425: WordPress Social Photo Feed XSS Flaw

CVE-2026-5425 Overview

CVE-2026-5425 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Widgets for Social Photo Feed plugin for WordPress. The flaw exists in all versions up to and including 1.7.9 and stems from insufficient input sanitization and output escaping on the feed_data parameter keys. Unauthenticated attackers can inject arbitrary web scripts that execute when users access the affected pages. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Unauthenticated attackers can store malicious JavaScript that executes in visitors' browsers, enabling session theft, administrative account takeover, and arbitrary actions on behalf of authenticated users.

Affected Products

• WordPress Widgets for Social Photo Feed plugin versions up to and including 1.7.9
• Plugin slug: social-photo-feed-widget
• Affected files include social-photo-feed-widget.php and trustindex-feed-plugin.class.php

Discovery Timeline

• 2026-04-04 - CVE-2026-5425 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-5425

Vulnerability Analysis

The vulnerability resides in how the Widgets for Social Photo Feed plugin processes the feed_data parameter. The plugin accepts user-controlled input through this parameter and stores it without performing adequate input sanitization. When the stored data is later rendered into a page, the plugin fails to apply proper output escaping, allowing attacker-supplied script content to execute in the context of the rendered page.

Because this is a stored XSS variant, the malicious payload persists in the WordPress database. Every visitor that loads the affected page triggers execution of the injected script. The scope is changed (CVSS Scope: Changed), meaning the injected script can affect resources beyond the vulnerable component's security authority, such as the administrator's authenticated session.

Root Cause

The root cause is twofold. First, the plugin does not sanitize the keys of the feed_data parameter before persisting them. Developers commonly sanitize values but overlook array keys, which is the exact pattern exploited here. Second, the plugin emits these key values back into HTML output without escaping functions such as esc_html(), esc_attr(), or wp_kses(). The patch landed in version 1.8 of the plugin via WordPress.org changeset 3486529.

Attack Vector

The attack is remotely exploitable over the network and requires no authentication or user interaction to inject the payload. An attacker submits a crafted request to the plugin endpoint that processes feed_data, embedding JavaScript within the parameter keys. The payload is stored server-side. When any user — including an administrator — visits an affected page, the browser executes the script in the site's origin. This enables cookie theft, session hijacking, forced administrative actions, and pivoting to broader site compromise.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for technical specifics on the affected code paths.

Detection Methods for CVE-2026-5425

Indicators of Compromise

• Unexpected <script>, onerror=, or onload= content stored within plugin-related options or post meta tied to the social-photo-feed-widget plugin.
• Outbound requests from site visitors to attacker-controlled domains shortly after loading pages that include the social photo feed widget.
• WordPress administrator sessions performing unusual actions such as new user creation or plugin installation immediately after viewing widget-containing pages.

Detection Strategies

• Review the plugin version currently installed and flag any deployment running 1.7.9 or earlier.
• Inspect database tables wp_options and wp_postmeta for serialized feed_data entries containing HTML event handlers or <script> tags.
• Deploy a Web Application Firewall (WAF) rule that inspects request parameters for script payloads targeting the plugin's AJAX or admin endpoints.

Monitoring Recommendations

• Enable WordPress audit logging to record plugin configuration changes and unauthenticated POST requests touching the social photo feed widget.
• Monitor web server access logs for anomalous POST volumes to admin-ajax.php referencing the plugin's actions.
• Alert on creation of new WordPress administrator accounts or changes to the siteurl and home options shortly after suspicious widget traffic.

How to Mitigate CVE-2026-5425

Immediate Actions Required

• Update the Widgets for Social Photo Feed plugin to version 1.8 or later immediately on all WordPress sites.
• Audit existing plugin configurations and stored feed data for previously injected script content and remove malicious entries.
• Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

The vendor addressed CVE-2026-5425 in version 1.8 of the plugin. The fix was committed in WordPress.org changeset 3486529, modifying both social-photo-feed-widget.php and trustindex-feed-plugin.class.php to apply proper sanitization on feed_data keys and escape values on output. Review the official changeset diff to validate patch coverage.

Workarounds

• Deactivate and remove the Widgets for Social Photo Feed plugin if the patched version cannot be deployed immediately.
• Restrict access to WordPress administrative endpoints and plugin AJAX handlers using IP allowlists at the WAF or reverse proxy layer.
• Apply a Content Security Policy (CSP) header that disallows inline script execution to limit XSS payload impact.

# Update the plugin via WP-CLI to the patched version
wp plugin update social-photo-feed-widget --version=1.8

# Verify the installed version
wp plugin get social-photo-feed-widget --field=version

# If a patch cannot be applied, deactivate the plugin
wp plugin deactivate social-photo-feed-widget