This vulnerability is an improper neutralization of input during web page generation (CWE‑79) in the SnapWidget Social Photo Feed Widget plugin, which allows a DOM‑based cross‑site scripting flaw. An attacker can embed malicious scripts that run in the context of users who view the feed, potentially allowing session hijacking, defacement, or other client‑side compromises.

The SnapWidget Social Photo Feed widget for WordPress, version 1.1.0 or earlier. Any WordPress installation that has the plugin installed in a site accessible through a browser is affected. No other WordPress core versions or plugins are mentioned as impacted.

The flaw carries a CVSS score of 6.5, indicating moderate severity, but the EPSS score is below 1 %, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a publicly reachable website that hosts the plugin, where an attacker can supply malicious input that is reflected into the DOM and executed in browsers of site visitors. No authentication or privileged access is required for the containing page to trigger the vulnerability.