CVE-2021-25120: Easysocialfeed Easy Social Feed

Medium severity, CVSS 6.1. EPSS: 2.9% chance of exploitation in the next 30 days.

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

Affected products

• Easysocialfeed Easy Social Feed: before 6.2.7 (fixed in 6.2.7); before 6.3.4 (fixed in 6.3.4)

Published 2022-04-18. Last modified 2026-06-17.