CVE-2021-25120

The CVE-2021-25120 affects the WordPress plugins Easy Social Feed Free/Pro prior to version 6.2.7. Affected component: parameters used via AJAX actions that are not sanitized before being reflected in responses, enabling a reflected Cross-Site Scripting (XSS) condition. The issue can execute Java...

CVE-2024-1219

CVE-2024-1219 affects the WordPress plugin Easy Social Feed (pre-6.5.6). The issue is that some shortcode attributes are not validated or escaped before being output, enabling Stored XSS by a user with as little as a contributor to potentially affect admin users. Public references in the connecte...

CVE-2024-30526

CVE-2024-30526 is a Cross-Site Request Forgery (CSRF) vulnerability reported in the Easy Social Feed WordPress plugin. Public sources confirm the issue affects Easy Social Feed versions listed as up to 6.5.6 (i.e., vulnerable through 6.5.6, with n/a indicating no earlier fixed version publicly do...

CVE-2024-1278

CVE-2024-1278 affects the WordPress plugin “Easy Social Feed – Social Photos Gallery – Post Feed – Like Box.” The vulnerability is Stored XSS through the plugin’s shortcodes, specifically the efb_likebox shortcode, in all versions up to 6.5.4. The root cause is insufficient input sanitization and...

CVE-2024-1214

CVE-2024-1214 (Easy Social Feed – Social Photos Gallery – Post Feed – Like Box, WordPress) is a CSRF vulnerability in the plugin across all versions up to 6.5.4 due to missing or incorrect nonce validation on the save_groups_list function. This allows unauthenticated attackers to disconnect a sit...

CVE-2024-1213

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box WordPress plugin is affected by a CSRF vulnerability (CVE-2024-1213) affecting all versions up to 6.5.4, caused by missing or incorrect nonce validation in esf_insta_save_access_token and efbl_save_facebook_access_token. This ena...

CVE-2024-30180

The CVE CVE-2024-30180 concerns an Improper Neutralization of Input During Web Page Generation (Stored XSS) in the WordPress plugin Easy Social Feed – Social Photos Gallery – Post Feed – Like Box. Publicly disclosed details indicate the vulnerability affects Easy Social Feed versions up to 6.5.3 ...

CVE-2023-48740

CVE-2023-48740 corresponds to a Missing Authorization / Broken Access Control vulnerability in WordPress plugin Easy Social Feed (versions up to 6.5.1). Root cause per Patchstack/Red Hat/NVD wording: incorrectly configured access control security levels allowing unauthorized access to restricted ...

CVE-2023-6883

CVE-2023-6883 : The Easy Social Feed plugin for WordPress (versions up to 6.5.2) is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This allows authenticated attackers with subscriber-level access and above to perform actions such as m...

CVE-2022-4474

The CVE-2022-4474 entry affects the Easy Social Feed WordPress plugin (versions prior to 6.4.0). The issue is a failure to validate and escape certain shortcode attributes, causing Stored XSS that can be triggered by low-privilege users (contributor) and exploited against higher-privilege users (...