The Widgets for Tiktok Feed plugin for WordPress is susceptible to stored cross‑site scripting through its 'trustindex-feed' shortcode. Because the plugin does not adequately sanitize or escape user‑supplied attributes, an authenticated user with contributor or higher privilege can inject malicious scripts that will run whenever a visitor loads a page containing the shortcode. This flaw corresponds to CWE‑79 and allows attackers to hijack sessions, deface content, or perform other client‑side attacks.

All installations of the Widgets for Tiktok Feed plugin for WordPress with version numbers up to and including 1.7.3 are affected. The vulnerability is present on any site that uses this plugin in those versions.

The reported CVSS score of 6.4 ranks the flaw as moderate, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The flaw requires an authenticated contributor or higher role, meaning an attacker must first obtain sufficient permissions to add or edit the shortcode. Although not listed in the CISA KEV catalog, the combination of moderate severity and the need for elevated privileges means security teams should treat this as a noteworthy risk, especially on sites with open contributor access or shared hosting environments.