PT-2025-39590 · WordPress · Ht Feed

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-60147

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

**Name of the Vulnerable Software and Affected Versions**

HT Feed versions through 1.3.0

**Description**

The HT Feed plugin contains a flaw related to improper input handling during web page creation, which allows for Stored Cross-site Scripting (XSS). This means an attacker could inject malicious scripts into web pages viewed by other users. The issue allows for the execution of arbitrary code within the context of a user's browser.

**Recommendations**

Update HT Feed to a version later than 1.3.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60147

Affected Products

Ht Feed

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-60147 · Security Note
• https://patchstack.com/database/wordpress/plugin/ht-instagram/vulnerability/wordpress-ht-feed-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1971499196130976015 · Twitter Post