WordPress · Wp Social Ninja · CVE-2025-13007
**Name of the Vulnerable Software and Affected Versions**
WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress versions up to and including 3.20.3
**Description**
The WP Social Ninja plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of externally-sourced content. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when a user accesses a page containing the injected content, provided the attacker can post malicious content to a connected Google Business Profile or Facebook page.
**Recommendations**
Update the WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin to a version later than 3.20.3.