The Widgets for Tiktok Feed plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'trustindex-feed' shortcode does not adequately sanitize or escape user-supplied attributes, allowing authenticated contributors or higher to inject arbitrary JavaScript. This script executes in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.7.3. There is no vendor advisory or patch information available at this time.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who access the infected pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authenticated access, limiting its impact to environments where untrusted users have contributor or higher roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the 'trustindex-feed' shortcode or the plugin if possible to prevent exploitation.