The Easy Social Feed – Social Photos Gallery and Post Feed for WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'efb_likebox' shortcode. This flaw is due to inadequate sanitization and escaping of user-supplied attributes, enabling authenticated users with contributor-level or higher privileges to inject arbitrary web scripts. These scripts persist in the plugin's output and execute in the context of any user viewing the infected page. The vulnerability affects all versions up to 6.5.4 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No patch or official fix information is currently available.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages rendered by the plugin. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as session hijacking or data theft limited to the scope of the injected script. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level permissions to trusted users only. Avoid using the 'efb_likebox' shortcode with untrusted input. Monitor vendor channels for updates and apply patches promptly once available.