WordPress security by component

Smash Balloon Social Post Feed

Plugin description

Smash Balloon Social Post Feed displays Facebook posts and feeds within WordPress pages and posts.

Smash Balloon Social Post Feed (custom-facebook-feed) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 02, 2026; the highest published CVSS base score is 7.2.

Plugin slug: custom-facebook-feed

Latest vulnerability

CVE-2026-93756: Smash Balloon Social Post Feed – Simple Social Feeds for WordPress: Stored XSS through Facebook comments in feed previews

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution. No further endpoint or implementation detail is disclosed beyond the path described here.

PublishedOct 02, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for custom-facebook-feed
		Safe version
Oct 02, 2026	CVE-2026-93756 Smash Balloon Social Post Feed – Simple Social Feeds for WordPress: Stored XSS through Facebook comments in feed previews The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution. No further endpoint or implementation detail is disclosed beyond the path described here.	See mitigation notes	CVE7.2
Aug 16, 2026	CVE-2026-16775 Smash Balloon feed id shortcode attribute permits Contributor stored XSS Smash Balloon Social Post Feed through 4.9.0 does not adequately sanitize and escape the id attribute of its feed shortcode. A Contributor can store a script-capable value in post content, and the payload executes whenever a visitor views the affected feed. The public.	See mitigation notes	CVE6.4
Oct 22, 2025	CVE-2025-49937 Smash Balloon Social Post Feed: A security weakness Smash Balloon Social Post Feed is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3
Jun 10, 2025	CVE-2025-4577 Smash Balloon Social Post Feed – Simple Social Feeds for: Cross-site scripting Smash Balloon Social Post Feed – Simple Social Feeds for is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Apr 15, 2024	CVE-2024-31379 Smash Balloon Social Post Feed: Cross-site request forgery Smash Balloon Social Post Feed is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers