rootpwn

high · CVSS v3 7.2 · EPSS 0.00267

CVE-2026-93756

The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to stored XSS via Facebook comment messages. Unauthenticated attackers

Overview

The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to stored XSS via Facebook comment messages. Unauthenticated attackers can inject scripts that run when admins preview the feed builder, potentially leading to arbitrary plugin installation and server-side code execution.

Description

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.

Impact

Confidentiality: injected scripts can exfiltrate admin credentials or session cookies. Integrity: arbitrary plugin installation can alter site content. Availability: potential site compromise. Impacted parties: WordPress site administrators using the Smash Balloon plugin.

Remediation

Update the Smash Balloon Social Post Feed plugin to version 4.13.1 or later. If an update is not possible, disable the feed builder preview or remove Facebook comment integration. Ensure WordPress core and other plugins are up to date. Deploy a web application firewall to block XSS payloads.

Risk context

High severity with an EPSS of 0.00267 indicates a low probability but potentially damaging vulnerability. Defenders should prioritize patching within the next 24–48 hours.

Affected products

  • Smash Balloon Social Post Feed
  • WordPress

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
0.00267

XSS WordPress Plugin Stored XSS Admin Social Feed CVE-2026-93756

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html().

View analysis

high

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.

View analysis