CVE-2021-25120
Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 2.9%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
18 Apr 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues
Affected products
Unknown · Easy Social Feed ProUnknown · Easy Social Feed – Social Photos Gallery – Post Feed – Like BoxWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →