CVE-2022-4477: medium-severity vulnerability in Smash Balloon Social Post Feed
Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Smash Balloon Social Post FeedRelated CVEs — Smash Balloon Social Post Feed
In the same product, most dangerous first.
CVE-2021-24508—Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSSEPSS 1.3%CVE-2021-25065—Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.0%CVE-2021-24918—Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSSEPSS 0.7%