CVE-2021-24918CWE-79

Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

published November 29, 2021

CVSS
—
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-29T08:25Z
EPSS history
Timeline
  • 29 NOV 08:25Z
    Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
    cvelistv5