Stored Cross-Site Scripting Vulnerability in Social Feed Gallery Portfolio Plugin for WordPress

CVE-2025-13896

What is CVE-2025-13896?

The Social Feed Gallery Portfolio plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) via the 'id' parameter in the [igp-wp] shortcode. This issue originates from inadequate input sanitization and output escaping mechanisms. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious web scripts into pages. These scripts are executed when users visit the compromised pages, potentially leading to unauthorized actions or the theft of sensitive information.

References