CVE-2026-121519

Name of the Vulnerable Software and Affected Versions Social Slider Feed – Social Media Feed & Gallery Widgets versions prior to 2.3.9

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By exploiting a missing current user can() check in the Factory framework's connect() dispatcher, attackers can bypass the manage options capability gate to harvest a wis edit feed nonce and overwrite the slidespeed parameter. This allows the injection of arbitrary web scripts that execute whenever a user views a public page embedding the feed shortcode.

Recommendations Update Social Slider Feed – Social Media Feed & Gallery Widgets to version 2.3.9 or later. As a temporary mitigation, restrict access to the slidespeed parameter and the connect() dispatcher in the Factory framework.