CVE-2025-14726 - CVE House
Back to Database
Status published Medium CVE-2025-14726

Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints

Vulnerability Description

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14726

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • German

References

More from trustindex

View All →
CVE-2025-9436
Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
Medium 6.4
CVE-2025-8906
Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-12510
Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews
High 7.2
CVE-2025-12123
Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2023-3254
Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset
Medium 4.3

Affected Vendor

Affected Software

Widgets for Social Photo Feed
Vulnerable Versions:
0

Timeline

Official Publish: May 2nd, 2026
Last Modified: May 4th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration