Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Post Content in Feed Builder Preview
- ID
- WPSEC-2026-0011
- Plugin
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (custom-facebook-feed)
- Affected
- from 4.0 before 4.14.0
- Remediation
- Update to 4.14.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Smash Balloon Social Post Feed on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-93756, on 2026-10-01.
Description
The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook-sourced content (comment messages, visitor and group post text and author names, story text, and shared-link titles and descriptions) in versions 4.0 up to, and including, 4.13.0. This is due to insufficient sanitization of the data when it is ingested and to its output being rendered with v-html in the admin feed builder preview. This makes it possible for unauthenticated attackers who can comment on the connected Facebook Page or post to a group or visitor feed to inject arbitrary web scripts that execute when an administrator opens the feed builder.
References
- https://wpsec.com/vuln/WPSEC-2026-0011/
- https://plugins.svn.wordpress.org/custom-facebook-feed/tags/4.14.0/
- https://wordpress.org/plugins/custom-facebook-feed/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS