← Vulnerability feed

Vulnerability record · CVE-2020-36739 · published 1 July 2023

CVE-2020-36739: Slickremix feed them social cross-site request forgery vulnerability

Slickremix · Feed Them Social

The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the my_fts_fb_load_more() function. This makes it possible for unauthenticated attackers to load feeds via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 CVSS 3.1 Medium EPSS 0.48% · top 61.3% CWE-352 · Cross-site request forgery
4.3CVSS 3.1 base score
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the my_fts_fb_load_more() function. This makes it possible for unauthenticated attackers to load feeds via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ ExploitTechnical DescriptionThird Party Advisory
https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ Not Applicable
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2369818%40feed-them-social&new=2369818% Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fcbe3d1-449c-4135-bbf5-9ea9236e5328?source=cve Third Party Advisory
https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ ExploitTechnical DescriptionThird Party Advisory
https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ Not Applicable
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ Not Applicable
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2369818%40feed-them-social&new=2369818% Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fcbe3d1-449c-4135-bbf5-9ea9236e5328?source=cve Third Party Advisory

Track CVE-2020-36739 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-2437Slickremix feed them social deserialization of untrusted data vulnerabilityThe Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' …EPSS 1.7%9.8CVE-2015-9351Slickremix feed them social improper input validation vulnerabilityThe feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.EPSS 2.8%8.8CVE-2023-25056Slickremix feed them social cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <= 3.0.2 versions.EPSS 0.26%6.1CVE-2022-2532Slickremix feed them social cross-site scripting vulnerabilityThe Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle…EPSS 0.77%6.1CVE-2022-2383Slickremix feed them social cross-site scripting vulnerabilityThe Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle…EPSS 6.5%6.1CVE-2015-9350Slickremix feed them social cross-site scripting vulnerabilityThe feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.EPSS 0.91%9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed8.1CVE-2008-4128Cisco IOS HTTP Administration CSRF allows arbitrary command executionThe HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router is vulnerable to multiple cross-site request forgery flaws.…KEVEPSS 34%analysed

Source: NIST National Vulnerability Database (record CVE-2020-36739), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.