Smash Balloon Social Post Feed Simple Social Feeds For Wordpress
Monthly
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.