Include Mastodon Feed
Include Mastodon Feed has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Include Mastodon Feed has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Include Mastodon Feed is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-22660Include Mastodon Feed <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Include Mastodon Feed
Author
Wolfgang
Plugin that provides a Gutenberg block and an [include-mastodon-feed] shortcode to easily integrate mastodon feeds into wordpress pages. Supports personal and tag feeds. Account and post images are lazy loaded if preserveImageAspectRatio is set to true (default: false). The plugin is written in PHP and generates native JavaScript to fetch and render the mastodon feed. No special libraries needed. Styling works out-of-the-box. For a nice custom column layout check out the awesome Columns Guide by @oldrup – using WordPress native Gutenberg blocks (pattern json file included) and some css magic.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C