CVE-2026-39507: WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the Social Slider Feed WordPress plugin by Themeisle, affecting all versions up to and including 2.3.2. The flaw is reachable over the network and requires no authentication, but a victim must interact with a malicious link or page for the attack to succeed. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session hijacking, content tampering, and limited service disruption. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker can reach it from the internet without any foothold on the host.

• AuthenticationNot required

  No account or session credential is needed; the vulnerability is exploitable by an anonymous, unauthenticated request.

• Victim interactionRequired

  A victim must follow a crafted link or visit a malicious page that triggers the injected script in their browser.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to trigger the vulnerability.

Blast Radius

• An attacker executes arbitrary JavaScript in the victim's browser session, enabling theft of session tokens or authentication cookies.
• Injected script can read and exfiltrate page content visible to the victim, including any displayed customer or site data.
• The attacker can alter the rendered page content the victim sees, facilitating phishing or credential-harvesting within the trusted site origin.
• Browser-side resource abuse or redirects can degrade or disrupt the victim's interaction with the affected WordPress site.