Cyber Resilience

CVE-2026-5425

High

Published: 04 April 2026

Published
04 April 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0012 30.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5425 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-5425 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Widgets for Social Photo Feed plugin for WordPress, affecting all versions up to and including 1.7.9. The flaw stems from insufficient input sanitization and output escaping of the 'feed_data' parameter keys, allowing arbitrary web scripts to be injected into pages. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and scope change.

Unauthenticated attackers can exploit this vulnerability remotely by submitting malicious payloads through the 'feed_data' parameter, resulting in stored scripts that execute in users' browsers whenever they access the affected pages. This enables potential theft of sensitive data, such as session cookies or credentials, session hijacking, or further compromise of site functionality for any authenticated users viewing the injected content.

Patches are available in version 1.8 of the plugin, as evidenced by code changesets in the WordPress plugin trac repository comparing files from tags 1.7.8 to 1.8, including social-photo-feed-widget.php and trustindex-feed-plugin.class.php. Additional details are provided in the Wordfence threat intelligence advisory.

EU & UK References

Vulnerability details

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible…

more

for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Stored XSS in public-facing WordPress plugin enables remote unauthenticated exploitation of web application (T1190) and injection/execution of arbitrary JavaScript in victim browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the insufficient input sanitization of the 'feed_data' parameter that enables unauthenticated attackers to inject arbitrary XSS payloads.

prevent

Mitigates the lack of output escaping that allows stored scripts to execute in users' browsers when accessing injected pages.

prevent

Requires timely remediation of the flaw through patching to version 1.8, which fixes the sanitization and escaping issues in the plugin.

References