EUVD-2026-53295
GHSA-rqhq-6w5v-rw72
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring user interaction and social engineering (AC:H, UI:R); no auth needed; scope changes as script crosses browser context boundary.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Smash Balloon Social Photo Feed - Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected XSS in Smash Balloon Social Photo Feed for WordPress (all versions through 6.11.3) allows unauthenticated attackers to inject arbitrary JavaScript via the REQUEST_URI query string in admin callout pages. Successful exploitation requires tricking an authenticated WordPress user - likely an administrator - into clicking a crafted link, after which the injected script executes in their browser session. No public exploit code or CISA KEV listing has been identified; the CVSS vector assigns high attack complexity (AC:H) and required user interaction (UI:R), placing real-world risk below the raw severity suggests.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization of the PHP REQUEST_URI superglobal before HTML output. The vulnerable file is admin/SBI_Callout.php within the 'instagram-feed' WordPress plugin package, with four distinct reflection points at lines 319, 361, 386, and 448. Because REQUEST_URI contains the full URL of the current request - including attacker-controlled query parameters - an unsanitized echo of this value into page output allows script injection. The CVSS S:C (changed scope) metric reflects that the injected script executes within the victim's browser security context, enabling cross-origin cookie access and DOM manipulation beyond the plugin's own page boundary.
RemediationAI
Update the Smash Balloon Social Photo Feed plugin to the version released after 6.11.3, which incorporates the fix committed in WordPress SVN changeset 3619076 (https://plugins.trac.wordpress.org/changeset/3619076/instagram-feed/trunk/admin/SBI_Callout.php). Until an update is applied, a Web Application Firewall rule blocking reflected script payloads (e.g., angle brackets, javascript: URI schemes) in query strings targeting /wp-admin/ paths will reduce exposure, though WAF rules carry a risk of false positives on legitimate admin navigation. The Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/33f1d8b9-3561-4347-8267-8c36d4c9071f provides additional context. Site administrators should also enforce strict Content-Security-Policy headers to limit the damage of any injected scripts.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today