Cross-Site Scripting Vulnerability in SnapWidget Social Photo Feed Widget by SnapWidget
CVE-2025-58241

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Snapwidget Social Photo Feed Widget
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58241?

The SnapWidget Social Photo Feed Widget is susceptible to a Cross-Site Scripting (XSS) vulnerability, which is triggered by improper neutralization of input during web page generation. Attackers can exploit this flaw to execute arbitrary JavaScript in the context of a user's browser, potentially leading to unauthorized access to sensitive information or manipulation of web content. The affected versions of the widget are up to 1.1.0, making it crucial for users to update and apply patches to mitigate this risk.

Affected Version(s)

SnapWidget Social Photo Feed Widget <= 1.1.0

References

https://patchstack.com/database/wordpress/plugin/snapwidg...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gilang Asra Bilhadi - DJ (Patchstack Alliance)
JSON
.