Stored Cross-Site Scripting in Widgets for Tiktok Feed Plugin for WordPress

CVE-2025-8906

What is CVE-2025-8906?

The Widgets for Tiktok Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through the 'trustindex-feed' shortcode. This vulnerability arises from inadequate input sanitization and output escaping for user-supplied attributes, affecting all versions up to and including 1.7.3. Authenticated users with contributor-level access or higher can exploit this flaw by injecting malicious scripts into webpages. These scripts will execute when users access the compromised pages, potentially leading to unauthorized actions and data exposure.

References