What’s Vulnerable › Products

smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress version is affected

Latest smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress vulnerabilities

• CVE-2026-93756 — Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview (CVSS 7.2)
• CVE-2026-16775 — Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4)
• CVE-2025-4577 — Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute (CVSS 5.4)