CVE-2025-13880

MEDIUM

WP Social Ninja - WordPress <4.0.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.

References (5)

Core 5

Scores

CVSS v3 6.5
EPSS 0.0022
EPSS Percentile 12.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
adreastrian/WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets < 4.0.1
Published Dec 17, 2025
Tracked Since Feb 18, 2026