Unauthorized Data Modification in Flow-Flow Social Feed Stream Plugin for WordPress

CVE-2025-13866

What is CVE-2025-13866?

The Flow-Flow Social Feed Stream plugin for WordPress suffers from a security flaw that permits authenticated users with Subscriber-level access and higher to manipulate plugin settings. This issue arises from a lack of proper capability checks on the flow_flow_social_auth AJAX action, leading to the potential for attackers to inject arbitrary JavaScript code. As a result, whenever the plugin settings page is accessed, this malicious script may execute, posing a significant risk to site security.

References