Stored Cross-Site Scripting Vulnerability in Social Feed Gallery Portfolio Plugin for WordPress

CVE-2025-13896

What is CVE-2025-13896?

The Social Feed Gallery Portfolio plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) via the 'id' parameter in the [igp-wp] shortcode. This issue originates from inadequate input sanitization and output escaping mechanisms. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious web scripts into pages. These scripts are executed when users visit the compromised pages, potentially leading to unauthorized actions or the theft of sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References