CVE-2025-13007

MEDIUM 6.1

WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can post malicious content to a connected Google Business Profile or Facebook page.

CWE	CWE-79
Vendor	adreastrian
Product	wp social ninja – embed social feeds, user reviews & chat widgets
Published	Dec 2, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for adreastrian wp social ninja – embed social feeds, user reviews & chat widgets

Be the first to know when new medium vulnerabilities affecting adreastrian wp social ninja – embed social feeds, user reviews & chat widgets are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

adreastrian / WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets

0 ≤ 3.20.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Kishan Vyas