{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6067", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-13T13:55:40.625Z", "datePublished": "2025-09-06T01:47:27.304Z", "dateUpdated": "2026-04-08T17:05:35.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:35.973Z"}, "affected": [{"vendor": "sjaved", "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.6.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` and `data-linktext` parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89eb2229-a507-4f7c-be31-58959d3eca62?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-facebook-likebox/trunk/facebook/frontend/assets/js/public.js#L81"}, {"url": "https://plugins.trac.wordpress.org/log/easy-facebook-likebox/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-06-17T17:19:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-05T13:45:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T13:57:35.287193Z", "id": "CVE-2025-6067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T14:05:40.043Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T13:57:35.287193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T13:57:37.679Z"}}], "cna": {"title": "Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "sjaved", "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.6.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-17T17:19:17.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-05T13:45:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89eb2229-a507-4f7c-be31-58959d3eca62?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-facebook-likebox/trunk/facebook/frontend/assets/js/public.js#L81"}, {"url": "https://plugins.trac.wordpress.org/log/easy-facebook-likebox/"}], "descriptions": [{"lang": "en", "value": "The Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` and `data-linktext` parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:35.973Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6067", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:35.973Z", "dateReserved": "2025-06-13T13:55:40.625Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-06T01:47:27.304Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` and `data-linktext` parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-6067", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-06T02:15:30.100", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-facebook-likebox/trunk/facebook/frontend/assets/js/public.js#L81"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/log/easy-facebook-likebox/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89eb2229-a507-4f7c-be31-58959d3eca62?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:11:57.965591+00:00", "value": {"mitigation_remediation": ["Update the Easy Social Feed plugin to the latest version (6.6.8 or newer) where the input is properly sanitized and escaped.", "If an update is unavailable, disable or remove the plugin to eliminate the attack surface.", "As an interim measure, restrict Contributor roles so that only Trusted administrators can create or edit posts and galleries, thereby limiting the ability to inject malicious content."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Easy Social Feed \u2013 Social Photos Gallery and Post Feed plugin, version 6.6.7 or earlier. The vulnerability exists for all installations of the plugin where contributors have permissions to add or edit posts or gallery items.", "description_and_impact": "The Easy Social Feed \u2013 Social Photos Gallery and Post Feed plugin for WordPress is susceptible to stored Cross\u2011Site Scripting. Unsanitized user input in the data\u2011caption and data\u2011linktext fields allows an authenticated Contributor or higher to embed arbitrary JavaScript code. When a viewer loads a page that displays the injected content, the malicious script runs in the context of the site, potentially exposing session cookies, defacing content, or redirecting users to malicious sites. This weakness permits an attacker to compromise the confidentiality, integrity, and availability of the site for all users that view the affected posts or galleries.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploit requires authenticated Contributor+ access and the ability to submit data to the plugin\u2019s fields. Successful exploitation results in arbitrary script execution on pages viewed by other users who see the injected content."}}}}, "created": "2026-04-21T19:15:26.039946+00:00", "updated": "2026-04-21T19:15:26.039958+00:00", "vendors": []}