CVE-2025-60147 WordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Feed ht-instagram allows Stored XSS.This issue affects HT Feed: from n/a through = 1.3.0...

CVE-2025-60147

CVE-2025-60147: Stored XSS in HT Feed (HT Plugin) affecting HT Feed versions from n/a up to 1.3.0 due to improper input neutralization during web page generation. Base score 6.5 (Medium). Patch status: Patched (remediation details not published in provided docs). Exploitation status not disclosed...

CVE-2025-8906

CVE-2025-8906 affects the WordPress plugin Widgets for Tiktok Feed (Widgets for TikTok Feed) up to version 1.7.3, enabling Stored XSS via the trustindex-feed shortcode. Exploitation requires attacker with contributor-level access or higher to inject script that runs in pages viewed by users. Word...

WordPress SAPO Feed plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Vinit Lakra in WordPress Plugin SAPO Feed versions = 2.4.2...

CVE-2025-53462

CVE-2025-53462 is a stored XSS in the SAPO Feed WordPress plugin. Affected: SAPO Feed

CVE-2025-58671 WordPress Auction Feed plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in morganrichards Auction Feed auction-feed allows Stored XSS.This issue affects Auction Feed: from n/a through = 1.1.4...

WordPress plugin SAPO Feed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

CVE-2025-54710 WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through = 1.0.21...

CVE-2025-6382

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render method takes the user-supplied name attribute and injects it directly into a...

CVE-2025-6382

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render method takes the user-supplied name attribute and injects it directly into a tag - both in the id attribute...

CVE-2025-6382 Taeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render method takes the user-supplied name attribute and injects it directly into a tag - both in the id attribute...

PT-2025-30647 · WordPress · Taeggie Feed

Name of the Vulnerable Software and Affected Versions: Taeggie Feed plugin for WordPress versions up to and including 0.1.10 Description: The Taeggie Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s taeggie-feed shortcode. The render method incorporates...

CVE-2023-47522

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

CVE-2023-47227

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Web-Settler Social Feed | All social media in one place plugin = 1.5.4.6 versions...

CVE-2023-23804

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Feed plugin = 1.2.7 versions...

CVE-2023-32577

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin = 4.0.0 versions...

CVE-2023-5661

The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-46077

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...

PT-2025-14153 · WordPress · Photoshelter For Photographers Blog Feed Plugin

Name of the Vulnerable Software and Affected Versions: PhotoShelter for Photographers Blog Feed Plugin versions 1.5.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attack...

CVE-2024-13678

The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...