TI-2021-07398 Aliases CVE-2021-25120 GHSA-vvmg-r8xj-p43w

Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting

LOW 33CWE-79Published 2022-04-18 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

Why it matters now

EPSS 0.02909 87th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Easy Social Feed Pro (Unknown): 6.2.7Easy Social Feed – Social Photos Gallery – Post Feed – Like Box (Unknown): 6.2.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Easy Social Feed Pro	6.2.7 to before 6.2.7	6.2.7	Patch available	CNA
Unknown	Easy Social Feed – Social Photos Gallery – Post Feed – Like Box	6.2.7 to before 6.2.7	6.2.7	Patch available	CNA

Easy Social Feed Pro VendorUnknown Affected 6.2.7 to before 6.2.7 Fixed in 6.2.7 Patch available CNA
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box VendorUnknown Affected 6.2.7 to before 6.2.7 Fixed in 6.2.7 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:easysocialfeed:easy_social_feed:::::pro:wordpress::	before 6.2.7	Vulnerable	sjaved
cpe:2.3:a:easysocialfeed:easy_social_feed:::::free:wordpress::	before 6.3.4	Vulnerable	sjaved

cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:pro:wordpress:*:* Versions before 6.2.7 Vulnerable ·sjaved
cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:free:wordpress:*:* Versions before 6.3.4 Vulnerable ·sjaved

Remediation

Fix · CNA Easy Social Feed Pro (Unknown) Fixed in 6.2.7
Fix · CNA Easy Social Feed – Social Photos Gallery – Post Feed – Like Box (Unknown) Fixed in 6.2.7

Timeline

2026-10-02 Threatist record created from CVE-2021-25120
2026-10-03 Alias added: GHSA-vvmg-r8xj-p43w

References

Exploit 1

https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-39cd206ab9f6

TI-2022-04089 Easy Social Feed – Social Photos Gallery – Post Feed – Like Box < 6.4.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2024-01133 Easy Social Feed < 6.5.6 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.3
TI-2024-19926 WordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-01190 Cross-site scripting in sjaved Easy Social Feed – Social Photos Gallery and Post Feed for… CVSS 3.1MEDIUM 6.4
TI-2024-01128 Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery CVSS 3.1MEDIUM 5.4
TI-2023-06288 Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification CVSS 3.1MEDIUM 4.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences