CVE-2026-125766: WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability

Q: Which installations are affected?

WPZOOM Social Feed Widget & Block installations up to and including version 2.4.1 are affected. The available data does not identify a first fixed version.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation is network-accessible, requires no privileges or user interaction, and has low attack complexity. Successful exploitation can expose sensitive information, with no indicated integrity or availability impact.

Q: Are default configurations affected?

The available data does not state whether exploitation depends on a particular configuration or whether default plugin settings are affected.

Q: How can I tell whether I am exposed?

Check whether the WordPress site has the WPZOOM Social Feed Widget & Block plugin installed and whether its version is 2.4.1 or earlier. The provided data does not include indicators of compromise or specific exposed data fields.

Published Nov 11, 2026

Updated

Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPZOOM Social Feed Widget & Block to a version that resolves this vulnerability.
Fixed in 2.4.2

Event History

Nov 11, 2026

CVE Published

via MITRE·12:42 PM

Data Sourced

via MITRE·12:42 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

WPZOOM Social Feed Widget & Block installations up to and including version 2.4.1 are affected. The available data does not identify a first fixed version.

What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation is network-accessible, requires no privileges or user interaction, and has low attack complexity. Successful exploitation can expose sensitive information, with no indicated integrity or availability impact.

Are default configurations affected?

The available data does not state whether exploitation depends on a particular configuration or whether default plugin settings are affected.

How can I tell whether I am exposed?

Check whether the WordPress site has the WPZOOM Social Feed Widget & Block plugin installed and whether its version is 2.4.1 or earlier. The provided data does not include indicators of compromise or specific exposed data fields.

CVE-2026-125766: WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are default configurations affected?

How can I tell whether I am exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are default configurations affected?

How can I tell whether I am exposed?