What’s Vulnerable › Products

smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin version is affected

Latest smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin vulnerabilities

• CVE-2026-15452 — Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String (CVSS 4.7)
• CVE-2026-12002 — Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter (CVSS 4.7)
• CVE-2025-4583 — Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute (CVSS 5.4)