Advisories · Technology
smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin.
Every CVE that names smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.7 Medium
Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
- smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
- smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute
- https://profiles.wordpress.org/smub/ Smash Balloon Instagram Feed Pro
- smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
- Cross-site scripting (XSS)