CVE-2021-25065: vulnerability in Smash Balloon Social Post Feed
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 1.0%
exploitation probability
1.0%top 37% of all CVEs
observed exploitation
nono source reports it
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Affected products
Unknown · Smash Balloon Social Post FeedRelated CVEs — Smash Balloon Social Post Feed
In the same product, most dangerous first.
CVE-2021-24508—Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSSEPSS 1.3%CVE-2021-24918—Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSSEPSS 0.7%CVE-2022-4477MEDIUMSmash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSSEPSS 0.5%