First published: Mon Nov 29 2021(Updated: )
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Smashballoon Smash Balloon Social Post Feed | <4.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID of this issue is CVE-2021-24918.
CVE-2021-24918 has a severity rating of medium with a score of 5.4.
The affected software of CVE-2021-24918 is the Smash Balloon Social Post Feed WordPress plugin versions up to and excluding 4.0.1.
An attacker can exploit CVE-2021-24918 by exploiting the lack of privilege or nonce validation in the plugin's settings, allowing them to store rogue JavaScript on each post and page of the vulnerable site.
Yes, a fix for CVE-2021-24918 is available in version 4.0.1 of the Smash Balloon Social Post Feed WordPress plugin.