CVE-2026-125799 · Package
NO FIX YET · SEE WHAT TO DO
Flow-Flow Social Stream, a WordPress plugin that shows social media feeds, writes sensitive information into files or directories that outsiders can reach. An attacker can retrieve that embedded sensitive data from the web.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Flow-Flow Social Stream up to and including 5.0.5 are exposed, since the data sits in externally reachable files. Sites without the plugin can skip it. The sources do not say which configuration or data is involved.
Not affected if plugin-not-installed
Who cares flow-flow-social-streams, self-hosted, wordpress
5.0.5.5.0.5Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a through 5.0.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.