Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
25Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendepss 0.7%
from disclosure to weapon
Published on NVDNov 29
VulnCheck+420d
exploitation probability
0.7%top 52% of all CVEs
observed exploitation
yesVulnCheck
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Affected products
Unknown · Smash Balloon Social Post Feed