Smash Balloon Social Post Feed (Unknown) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2023-01-16. Vendor: Unknown.

CVEs of Smash Balloon Social Post Feed

• CVE-2022-4477 - CVSS 5.4 (medium), 2023-01-16: The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in…
• CVE-2021-25065 - CVSS 5.4 (medium), 2022-01-17: The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
• CVE-2021-24918 - CVSS 5.4 (medium), 2021-11-29: The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a…
• CVE-2021-24508 - CVSS 6.1 (medium), 2021-09-13: The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action…