Smash Balloon Social Post Feed <= 4.15.1 - Unauthenticated Stored Cross-Site Scripting via Facebook Post Description Mention Tokens
- ID
- WPSEC-2026-3108
- Plugin
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (custom-facebook-feed)
- Affected
- from 2.5 before 4.16.0
- Remediation
- Update to 4.16.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-13
- Attack surface
- Smash Balloon Social Post Feed on WPSec AttackSurface
- Fix released
- Published
Description
The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mention tokens (@[id:type:name]) in the description of Facebook posts shown in a feed, in versions 2.5 up to, and including, 4.15.1. This is due to insufficient output escaping: the description is autolinked before mention tokens are parsed, and the token parser accepts any characters and joins the token's id and name into link HTML without escaping. A token can therefore swallow part of the autolinker's markup and leave an attribute quote open, so later text becomes attributes of an HTML tag. This makes it possible for unauthenticated attackers who can control the description text of a post that the site's feed displays, such as the caption of a photo, album or Facebook video from another account that the site’s Facebook page shares (shared-link previews, events, offers and YouTube, Vimeo or SoundCloud embeds use a different path and are not affected), to inject arbitrary web scripts that execute whenever a user views a page containing the feed.
References
- https://wpsec.com/vuln/WPSEC-2026-3108/
- https://plugins.svn.wordpress.org/custom-facebook-feed/tags/4.16.0/
- https://wordpress.org/plugins/custom-facebook-feed/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS