# Smash Balloon Social Post Feed <= 4.15.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Support Page System Information

- **ID:** WPSEC-2026-2390
- **Plugin:** Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (`custom-facebook-feed`), https://wordpress.org/plugins/custom-facebook-feed/
- **Affected versions:** from 4.0 before 4.15.1
- **Fixed in:** 4.15.1 (Update to 4.15.1 or later.)
- **Severity:** Medium 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/custom-facebook-feed
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2390/

## Description

The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the system information shown on the plugin's Support page in versions 4.0 up to, and including, 4.15.0. The system information string, which includes feed names and the plugin's global settings, was rendered as HTML with a Vue v-html binding, and wp_localize_script() decodes the HTML entities in it, so markup in those values becomes live. This makes it possible for authenticated attackers with administrator-level access or above to inject arbitrary web scripts that execute when an administrator views the Support page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2390/
- https://plugins.svn.wordpress.org/custom-facebook-feed/tags/4.15.1/
- https://wordpress.org/plugins/custom-facebook-feed/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2390/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.