CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

🗓️ 02 Dec 2025 06:40:24Reported by WordfenceType

Unauthenticated stored cross site scripting in WP Social Ninja up to 3.20.3 via external content import.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-13007	2 Dec 202508:14	–	circl
CNNVD	WordPress plugin WP Social Ninja 跨站脚本漏洞	2 Dec 202500:00	–	cnnvd
CVE	CVE-2025-13007	2 Dec 202506:40	–	cve
EUVD	EUVD-2025-200204	2 Dec 202506:40	–	euvd
NVD	CVE-2025-13007	2 Dec 202507:15	–	nvd
Patchstack	WordPress WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import vulnerability	2 Dec 202510:00	–	patchstack
Positive Technologies	PT-2025-48647	2 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-13007	3 Dec 202507:04	–	redhatcve
Vulnrichment	CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import	2 Dec 202506:40	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 1, 2025 to December 7, 2025)	11 Dec 202517:00	–	wordfence

[
  {
    "vendor": "adreastrian",
    "product": "WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.20.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-social-reviews/tags/3.20.1/app/Services/Platforms/Reviews/GoogleMyBusiness.php
plugins	www.plugins.trac.wordpress.org/browser/wp-social-reviews/tags/3.20.1/app/Views/public/reviews-templates/elements/review-content.php
plugins	www.plugins.trac.wordpress.org/browser/wp-social-reviews/tags/3.20.1/app/Services/Helper.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/16c9ed4a-9e9f-4f10-b3fd-7f0db2c86112
plugins	www.plugins.trac.wordpress.org/changeset

08 Apr 2026 16:37Current

CVSS 3.16.1

EPSS0.00171

CWE-79