Read the docs

Smash Balloon

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Smash Balloon records in CISA KEV

No Smash Balloon vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Custom Twitter Feeds 5 records MEDIUM Smash Balloon Social Post Feed 4 records MEDIUM Feeds For Youtube 2 records LOW Reviews Feed 2 records LOW

Records

4 records in Smash Balloon Social Post Feed · all components

TI-2022-04092 CVE-2022-4477 · GHSA-w6fg-m72j-wggm

Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS

Priority MEDIUM 58

The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a con…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00513 Published 2023-01-16 Fixed in 4.1.6
TI-2021-06795 CVE-2021-24508 · GHSA-h2xq-fv4r-5784

Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS

Priority LOW 30

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before o…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01343 Published 2021-09-13 Fixed in 2.19.2 CWE-79
Open these records in search →