CVE-2021-24918: Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Vulnerability summary
CVE-2021-24918 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in smashballoon smash_balloon_social_post_feed. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-11-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.68% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (jetpack.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Smashballoon1 product
Unknown1 product
- smash balloon social post feed≥ 4.0.1, < 4.0.1
Wordpress1 product
- custom-facebook-feed< 4.0.1
3 vendors · 3 products
References
3 links- jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-social-post-feed-plugin/X Refsource MISCExploitThird Party Advisory