CVE-2025-14726 Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindexfeedhookinstagram/troubleshooting' and '/trustindexfeedhookinstagram/submit-data' REST API endpoints in all versions up...

PT-2026-36564

Name of the Vulnerable Software and Affected Versions Widgets for Social Photo Feed versions prior to 1.9 Description Missing capability checks on the '/trustindex feed hook instagram/troubleshooting' and '/trustindex feed hook instagram/submit-data' REST API endpoints allow unauthenticated...

EUVD-2025-31204

Malicious code in bioql PyPI...

CVE-2025-8906

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8906 Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8906

CVE-2025-8906 affects the WordPress plugin Widgets for Tiktok Feed (Widgets for TikTok Feed) up to version 1.7.3, enabling Stored XSS via the trustindex-feed shortcode. Exploitation requires attacker with contributor-level access or higher to inject script that runs in pages viewed by users. Word...

PT-2025-39480

Name of the Vulnerable Software and Affected Versions Widgets for Tiktok Feed plugin for WordPress versions up to and including 1.7.3 Description The Widgets for Tiktok Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'trustindex-feed' shortcode. This is due to...