CVE-2025-6382
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Published: 2025-07-24T10:15:27.140
The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render() method takes the user-supplied name attribute and injects it directly into a tag – both in the id attribute and inside jQuery.getScript() – without proper escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Related CVE by CWE
No related CWE found.
Top CVE for Vendor
No vendor taxonomy on this entry.
Recently Exploited Similar Vulnerabilities
No recent KEV-listed items for this vendor/product.
How to fix CVE-2025-6382
Description: The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render() method takes the user-supplied name attribute and injects it directly into a tag – both in the id attribute and inside jQuery.getScript() – without proper escaping. This […]
Affected Versions:
❌ Vulnerable: ≤ 0.1.10
✅ Safe: ≥ 0.1.11
Exploit Difficulty: EASY
⏱️ Time to exploit: < 1 hour
🛠️ Required skills: Basic web security knowledge
💰 Public exploits: Likely available
How to Fix:
- Check if you're running the affected product
- Verify version (vulnerable: ≤ 0.1.10)
- Update to ≥ 0.1.11 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access
- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)
- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations
Exploit Difficulty Assessment
Affected Versions
Vulnerability Timeline
CVE details first published to NVD database
Added to this CVE tracking system
Detection Rules & IOCs
No specific detection rules generated for this vulnerability type.
No vendor/product data available.