XT Event Widget for Social Events
XT Event Widget for Social Events has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is PHP Remote File Inclusion, behind 1 of the records (100%).
The one issue recorded for XT Event Widget for Social Events has a vendor fix available, so running the current release closes it.
All of these findings were reported by timomangcut. XT Event Widget for Social Events is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-47531XT Event Widget for Social Events <= 1.1.7 - Authenticated (Contributor+) Local File Inclusion
Read the full analysisVulnerability Records

XT Event Widget for Social Events
Author
Xylus Themes
XT Event Widget for Social Events is the most powerful WordPress plugin for displaying Facebook events on your website. Whether you run a community page, a business, or a yoga studio — this plugin lets you create stunning, real-time event feeds in minutes. 🚀 No Facebook API Key Required! Our intelligent scraping engine fetches events directly — no app creation, no tokens, no hassle. 🔥 Upgrade to Pro | 📖 Documentation | 💬 Support 🎯 Live Feed Builder (New!) Create and manage multiple event feeds with our intuitive visual builder: Event IDs Source — Paste specific Facebook Event IDs to display selected events iCal URL Source — Import events from any Facebook iCal/ICS export link Facebook Page Source — Fetch all events from any public Facebook Page automatically (Pro) Facebook Group Source — Fetch all events from any public Facebook Group automatically (Pro) 🎨 Beautiful Layouts Choose from a variety of stunning, responsive layouts: Card Grid — Modern, responsive grid cards with event images, dates, and venue info List View — Clean, classic list layout for a traditional event listing Timeline — Vertical chronological timeline with elegant date markers (Pro) Compact List — Maximum event details packed into a space-saving design (Pro) Minimal Grid — Sleek, minimalistic grid with subtle hover effects (Pro) Ticket List — Specialized layout highlighting ticket info and event dates (Pro) Masonry — Dynamic, Pinterest-style staggered grid layout (Pro) ⚙️ Powerful Features Gutenberg Block — Embed event feeds directly from the WordPress Block Editor Advanced Date Filters — Show today’s, this week’s, this month’s, upcoming, or custom date range events Hide Online Events — Filter out virtual/online events from your feed Configurable Pagination — AJAX load-more or numbered pagination with customizable events per page Smart Caching — Set your own cache duration (minutes) to balance freshness vs. performance Auto Background Sync — Events and HQ images are fetched in the background without slowing down your page High-Quality Images — Automatically fetches full-resolution cover photos for every event Location & Venue Data — Displays venue name, address, and coordinates scraped from Facebook Organizer Details — Shows event creator/organizer name with link Responsive Design — Looks great on desktop, tablet, and mobile Custom CSS — Add your own CSS per feed for full design control Shortcode Support — Use [xtfeprofeed id="FEED_ID"] anywhere on your site Legacy Widget Support — Classic WordPress widget for sidebars and footers Legacy Shortcode — [wpfb_events page_id="YOUR_PAGE_ID" max_events="10"] still supported (Pro) 🔌 Facebook Embeddable Page Widget Two easy ways to display Facebook’s official embeddable page widget: Shortcode: [fb_event_widget page_url="https://www.facebook.com/redbull/" width="340" height="500" hide_cover="false" hide_cta="true" small_header="true"] WP Widget: Use the “Facebook Page Event Widget” from the WordPress widget area 🔑 Facebook App Authentication (Optional) For the legacy widget that uses the official Facebook Graph API: Connect your Facebook account with one click — no manual app creation needed Or create your own Facebook App for full control (How to create a Facebook App) Your site must use HTTPS (SSL certificate) ⭐ Pro Features Unlock the full potential with XT Facebook Events Pro: Facebook Page Source — Automatically scrape all events from any public Facebook Page Facebook Group Source — Automatically scrape all events from any public Facebook Group 5 Additional Layouts — Timeline, Compact List, Minimal Grid, Ticket List, and Masonry Legacy Grid Shortcode — Beautiful responsive event grid via shortcode Gutenberg Block Shortcode — Enhanced block editor support Activity Logs — Track all API calls, image fetches, and errors in a detailed log viewer License & Updates — Automatic updates and priority support Background Pagination — Silently fetches all event pages in the background for large event lists 👉 Get Pro Now 🔗 Our Other Plugins WP Bulk Delete — Delete posts, pages, comments, users, taxonomy terms, and meta fields in bulk using powerful filters and conditions. Easy Events Calendar — Create and manage events with ease using a simple and powerful WordPress event calendar. WP Event Aggregator — Import Facebook, Eventbrite, Meetup, iCalendar (ICS), and other event sources into your WordPress Event Calendar. Import Social Events — Import Facebook events into your WordPress website or event calendar with beautiful shortcode and widget displays. Import Eventbrite Events — Import Eventbrite events into your WordPress website or event calendar with shortcode and widget support. Import Meetup Events — Import Meetup.com events into your WordPress website effortlessly. Event Schema / Structured Data — Automatically generate JSON-LD Event Schema markup for Google Rich Results and improved SEO. WP Smart Import — Import CSV files into WordPress posts, pages, and custom post types with advanced mapping options. XT Feed for LinkedIn — Automatically share WordPress posts to LinkedIn and expand your content reach with one click.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C