Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
25Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck.
ssvc Attendepss 0.7%
da publicação à arma
Publicada no NVD29 de nov.
VulnCheck+420d
probabilidade de exploração
0.7%top 52% das CVEs
exploração observada
simVulnCheck
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Produtos afetados
Unknown · Smash Balloon Social Post Feed