CVE-2025-68595

MediumCVSS 5.3

Published: 24/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Widgets for Social Photo Feed plugin (versions up to and including 1.8) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Widgets for Social Photo Feed from n/a through 1.8.

Risk Assessment

An attacker could perform operations or access data without the required permissions, potentially leading to unauthorized widget changes or information disclosure.

Recommendation

Update the Widgets for Social Photo Feed plugin to a version later than 1.8 that fixes the vulnerability. Verify WordPress role permissions.

Other vulnerabilities in Widgets for Social Photo Feed

CVE-2025-14726Medium
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.

Original NVD description (English source)

Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS