Social Slider Feed < 2.2.9 – Admin+ Stored XSS | CVE 2025-0717 | Plugin Vulnerabilities

Description

To exploit the vulnerability, it is necessary:

1. Go to Appearance - Widgets
Instagram Facebook Slider
2. 2. Add the following widget (any one): Social Slider - Instagram, Social Slider - Facebook, Social Slider - Youtube.
3. Add the XSS payload to the Title and save it.
4. As a result of using this widget, XSS will be played.

Proof of Concept

1. Go to Appearance - Widgets - Instagram Facebook Slider (easier if you install classic-widgets plugin for managing widgets)
2. 2. Add the following widget (any one): Social Slider - Instagram, Social Slider - Facebook, Social Slider - Youtube.
3. Add the XSS payload, e.g: 123"onmouseover='alert(777)', to the Title and save it.
4. As a result of using this widget, XSS will be played.

Affects Plugins

instagram-slider-widget

Fixed in 2.2.9

References

CVE

URL

https://research.cleantalk.org/CVE-2025-0717

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krugov Artyom

Submitter

Krugov Aryom

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

31f734fc-d474-46b3-98eb-04761cab8878

Timeline

Publicly Published

2025-03-03 (about 10 months ago)

Added

2025-03-03 (about 10 months ago)

Last Updated

2025-03-03 (about 10 months ago)

Other

Published

Title

Published

2025-09-26

Title

Click & Tweet <= 0.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-10-31

Title

Employee Spotlight – Team Member Showcase & Meet the Team Plugin < 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-03-07

Title

My Calendar < 3.4.24 - Authenticated Stored XSS

Published

2025-06-18

Title

WPBakery Page Builder < 8.5 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder

Published

2025-02-24

Title

Profile Widget Ninja <= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting