CVE-2026-5425

creationtimestamp| type| source ---|---|--- 2026-04-04 11:15:30+00:00| seen| Telegram/gVbA1acGlW-fyY5rGlXdxs5pj98sQBeJD9ssu2cbcQUWpFQ 2026-04-04 12:28:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mioacgoemc2s 2026-04-05 07:30:28+00:00| seen|...

CVE-2026-5425 Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feeddata' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...