CVE-2025-8906 in Widgets for Tiktok Feed Plugin
Summary
by MITRE • 09/26/2025
The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2025
The vulnerability identified as CVE-2025-8906 affects the Widgets for Tiktok Feed plugin for WordPress, specifically targeting versions up to and including 1.7.3. This represents a critical security flaw that enables stored cross-site scripting attacks through the plugin's trustindex-feed shortcode functionality. The vulnerability stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or escape user-supplied attributes before processing them within the plugin's shortcode implementation. Attackers with contributor-level access or higher can exploit this weakness to inject malicious scripts that persist in the WordPress database, making the vulnerability particularly dangerous as it can affect any user who accesses pages containing the maliciously injected content.
The technical flaw manifests in the plugin's handling of shortcode attributes where user input is directly processed without proper sanitization measures. When an authenticated attacker with contributor privileges or above creates or modifies content using the trustindex-feed shortcode, they can inject malicious JavaScript code through attributes that are not properly escaped before being rendered in web pages. This stored XSS vulnerability allows attackers to execute arbitrary scripts in the context of a victim's browser session, potentially enabling session hijacking, credential theft, or other malicious activities. The vulnerability operates at the application layer and leverages the trust relationship between the WordPress platform and its users, making it particularly effective in environments where contributors have elevated privileges.
The operational impact of CVE-2025-8906 extends beyond simple script injection, as it provides attackers with persistent access vectors that can be exploited across multiple user sessions. Since the malicious scripts are stored within the WordPress database, they execute automatically whenever affected pages are accessed, creating a continuous threat that can affect numerous users without requiring repeated exploitation attempts. This vulnerability particularly impacts WordPress sites that rely heavily on contributor-level user permissions, as it allows these users to escalate their privileges and compromise the entire site's security. The stored nature of the attack means that even users who do not immediately access the compromised content can be affected when they later visit pages containing the malicious scripts.
Organizations should implement immediate mitigation strategies including updating to the latest version of the Widgets for Tiktok Feed plugin where the vulnerability has been addressed. System administrators should also consider implementing additional security measures such as restricting contributor privileges, implementing content security policies, and monitoring for suspicious shortcode usage patterns. The vulnerability aligns with CWE-79 which categorizes cross-site scripting flaws, and represents a clear violation of secure coding practices that should be addressed through proper input validation and output escaping mechanisms. From an ATT&CK perspective, this vulnerability maps to techniques involving privilege escalation and persistent threats, as attackers can use it to maintain access and execute malicious code across multiple sessions, making it a significant concern for WordPress security posture management and incident response planning.