WordPress Social Slider Feed Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the WordPress Social Slider Feed plugin, affecting versions prior to 2.2.9. This vulnerability allows authenticated users with administrative privileges to inject malicious scripts that are executed when the widget is displayed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the widget.

Reproduction

To reproduce this vulnerability, add a Social Slider widget (Instagram, Facebook, or YouTube) to the Appearance > Widgets section. Inject an XSS payload into the widget title and save it. The payload will be executed when the widget is displayed.

Remediation

Users are advised to update the Social Slider Feed plugin to version 2.2.9 or later.