Custom Facebook Feed EUVD-2026-91253

The target WordPress site must be running Smash Balloon Social Post Feed (Custom Facebook Feed) ≤4.13.0 with a feed connected to a Facebook Page whose comments are ingested, and an administrator must open the plugin's feed builder preview page for the stored payload to execute - the DOM evaluation occurs even if the comment section is not visually displayed (v-show rather than v-if). The attacker needs only a Facebook account to comment on the connected Page and requires NO WordPress credentials. Limiting factors: exploitation depends on a non-universal configuration (a connected public Facebook Page with comment display) and on an administrator actually loading the builder preview, and the escalation to server-side code execution additionally requires the separate unvalidated cff_install_addon AJAX path to be reachable.

This is a legitimately interesting flaw rather than a mere high-CVSS paper tiger, but its real-world urgency is moderate and gated by configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2, assigned by Wordfence) describes a remotely reachable, low-complexity, unauthenticated stored XSS with a changed scope - the injected payload executes in the WordPress administrator's authenticated browser context. The standout signal is not the base score but the documented exploitation path: because the plugin renders the Facebook comment message through Vue's v-html and uses v-show rather than v-if, attacker HTML (including onerror handlers) is evaluated in the DOM even when hidden, and it can be chained to the cff_install_addon AJAX handler's missing URL validation to install an arbitrary plugin from an attacker-controlled URL, potentially yielding server-side code execution. That chained impact is materially worse than the C:L/I:L impact metrics suggest, so the raw 7.2 understates worst-case severity. Counterbalancing this: no EPSS score, KEV status, or public PoC was provided in the intelligence set, so there is no evidence of active or at-scale exploitation - treat it as a credible but not yet weaponized issue. Note also a conflict between CVSS UI:N and the description, which states the payload executes only 'whenever an administrator accesses the feed builder preview page' - that is victim interaction (an admin loading a specific admin screen), so UI:N likely overstates reachability; verify with the vendor. Net: a real priority for sites running this plugin with a connected public Facebook Page, but not an emergency absent exploitation telemetry.

An attacker with only an ordinary Facebook account posts a comment containing a malicious HTML/JavaScript payload on a Facebook Page that a target WordPress site displays via the Smash Balloon plugin. When a site administrator later opens the feed builder preview screen, the stored comment is rendered via v-html and the script executes in the admin's authenticated session; because v-show (not v-if) is used, the payload fires even if the comment area is not visibly shown. No public exploit code was identified in the provided intelligence, though the advisory describes the full chain in enough detail to reproduce it.