🔐 CVE Alert

CVE-2025-13880

MEDIUM 6.5

WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modification

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.

CWE CWE-862
Vendor adreastrian
Product wp social ninja – embed social feeds, user reviews & chat widgets
Published Dec 17, 2025
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for adreastrian wp social ninja – embed social feeds, user reviews & chat widgets

Be the first to know when new medium vulnerabilities affecting adreastrian wp social ninja – embed social feeds, user reviews & chat widgets are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

adreastrian / WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets
0 ≤ 4.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8e3cb9-00b3-4500-adf0-c8a9fbf9d546?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Routes/api.php#L44 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Policies/SettingsPolicy.php#L14 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Services/PermissionManager.php#L176 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-social-reviews/tags/4.0.1/app/Http/Controllers/SettingsController.php#L144

Credits

Angus Girvan