Multiple WordPress plugins, including BlossomThemes Social Feed, are vulnerable to stored cross-site scripting due to the use of an outdated Magnific Popups library (v1.1.0) that does not properly sanitize or escape user-supplied attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages. The root cause is insufficient neutralization of input during web page generation (CWE-79). The upstream library fixed this issue in version 1.2.0 by disabling HTML content loading in certain fields by default. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity, with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages rendered by the plugin, which execute in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no indication of availability impact. No known exploits in the wild have been reported.

No official patch or update for BlossomThemes Social Feed has been provided yet. The upstream Magnific Popups library fixed the issue in version 1.2.0 by disabling HTML loading in certain fields by default. Users should monitor the vendor advisory for BlossomThemes Social Feed for an official fix or update that incorporates this upstream patch. Until then, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible to reduce exposure.