CVE-2021-24508: Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
Vulnerability summary
CVE-2021-24508 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in smashballoon smash_balloon_social_post_feed. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 71.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 13-09-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Smashballoon1 product
- smash_balloon_social_post_feed< 2.19.2
Unknown1 product
- smash balloon social post feed≥ 2.19.2, < 2.19.2
Wordpress1 product
- custom-facebook-feed< 2.19.2
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/2b543740-d4b0-49b5-a021-454a3a72162fX Refsource MISCExploitThird Party Advisory