CVE-2021-24508CWE-79

Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS

published September 13, 2021

CVSS
—
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01343 · 71.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-13T17:56Z
EPSS history
Timeline
  • 13 SEP 17:56Z
    Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
    cvelistv5