A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Spider Facebook Plugin. This vulnerability could allow a malicious actor to inject malicious scripts into the website, which could be executed when visitors visit the affected site.

This vulnerability was discovered and responsibly reported by LEE SE HYOUNG (hackintoanetwork).

The vulnerability is an XSS vulnerability that occurs in the spider-facebook.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to inject malicious scripts into the website.


The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

All versions of the Spider Facebook Plugin are affected by this vulnerability.


An attacker who successfully exploits this vulnerability could:

  • Inject malicious scripts into your website, which could allow them to:
    • Steal user information, such as cookies, session tokens, and passwords.
    • Redirect users to malicious websites.
    • Display malicious content on your website.
    • Take control of user accounts.


In light of the gravity of this high-severity vulnerability and the unavailability of a patched version, urgent actions are required:

  1. Maintain Vigilance: Continuously monitor the situation for updates or patches related to the Spider Facebook Plugin.
  2. Security Audits: Consider performing security audits on the website to proactively identify and address potential vulnerabilities.
  3. User Education: Educate website users about safe online practices to minimize the risk of falling prey to malicious attacks.
  4. Backup Strategy: Implement a robust backup and recovery strategy to safeguard the website’s data and content.
  5. Seek Alternatives: Explore alternative plugins to replace the Spider Facebook Plugin temporarily until a fix is available.


This vulnerability is a serious threat to the security of WordPress websites that use the Spider Facebook Plugin. Users of the Spider Facebook Plugin are strongly advised to uninstall the plugin and find an alternative solution. There is no patched version available, and the vendor has not responded to reports of the vulnerability.