Flow-Flow Social Feed Stream Missing Authorization Vulnerability Allowing Stored Cross-Site Scripting

A vulnerability exists in the Flow-Flow Social Feed Stream plugin for WordPress, specifically in versions 3.0.0 prior to 4.7.5. The issue arises from a missing capability check on the flow_flow_social_auth AJAX action, which allows authenticated attackers with Subscriber-level access and above to unauthorizedly modify plugin settings. This vulnerability also enables the injection of arbitrary JavaScript that executes whenever the plugin settings page is accessed.

Impact

Exploitation of this vulnerability could lead to stored cross-site scripting, where injected scripts are executed in the context of the user viewing the settings page.