CVE-2026-5425
Published: 04 April 2026
Summary
CVE-2026-5425 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-5425 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Widgets for Social Photo Feed plugin for WordPress, affecting all versions up to and including 1.7.9. The flaw stems from insufficient input sanitization and output escaping of the 'feed_data' parameter keys, allowing arbitrary web scripts to be injected into pages. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and scope change.
Unauthenticated attackers can exploit this vulnerability remotely by submitting malicious payloads through the 'feed_data' parameter, resulting in stored scripts that execute in users' browsers whenever they access the affected pages. This enables potential theft of sensitive data, such as session cookies or credentials, session hijacking, or further compromise of site functionality for any authenticated users viewing the injected content.
Patches are available in version 1.8 of the plugin, as evidenced by code changesets in the WordPress plugin trac repository comparing files from tags 1.7.8 to 1.8, including social-photo-feed-widget.php and trustindex-feed-plugin.class.php. Additional details are provided in the Wordfence threat intelligence advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18989
Vulnerability details
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible…
more
for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables remote unauthenticated exploitation of web application (T1190) and injection/execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient input sanitization of the 'feed_data' parameter that enables unauthenticated attackers to inject arbitrary XSS payloads.
Mitigates the lack of output escaping that allows stored scripts to execute in users' browsers when accessing injected pages.
Requires timely remediation of the flaw through patching to version 1.8, which fixes the sanitization and escaping issues in the plugin.