The Easy Social Feed – Social Photos Gallery and Post Feed plugin for WordPress is susceptible to stored Cross‑Site Scripting. Unsanitized user input in the data‑caption and data‑linktext fields allows an authenticated Contributor or higher to embed arbitrary JavaScript code. When a viewer loads a page that displays the injected content, the malicious script runs in the context of the site, potentially exposing session cookies, defacing content, or redirecting users to malicious sites. This weakness permits an attacker to compromise the confidentiality, integrity, and availability of the site for all users that view the affected posts or galleries.

WordPress sites running the Easy Social Feed – Social Photos Gallery and Post Feed plugin, version 6.6.7 or earlier. The vulnerability exists for all installations of the plugin where contributors have permissions to add or edit posts or gallery items.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploit requires authenticated Contributor+ access and the ability to submit data to the plugin’s fields. Successful exploitation results in arbitrary script execution on pages viewed by other users who see the injected content.