Smash Balloon Social Post Feed <= 4.15.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Support Page System Information
- ID
- WPSEC-2026-2390
- Plugin
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (custom-facebook-feed)
- Affected
- from 4.0 before 4.15.1
- Remediation
- Update to 4.15.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Smash Balloon Social Post Feed on WPSec AttackSurface
- Fix released
- Published
Description
The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the system information shown on the plugin's Support page in versions 4.0 up to, and including, 4.15.0. The system information string, which includes feed names and the plugin's global settings, was rendered as HTML with a Vue v-html binding, and wp_localize_script() decodes the HTML entities in it, so markup in those values becomes live. This makes it possible for authenticated attackers with administrator-level access or above to inject arbitrary web scripts that execute when an administrator views the Support page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2390/
- https://plugins.svn.wordpress.org/custom-facebook-feed/tags/4.15.1/
- https://wordpress.org/plugins/custom-facebook-feed/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS