First published: Mon Jan 17 2022(Updated: )
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Smashballoon Smash Balloon Social Post Feed | <4.1.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-25065 is a vulnerability in the Smash Balloon Social Post Feed WordPress plugin before version 4.1.1 that allows for reflected cross-site scripting (XSS) attacks.
CVE-2021-25065 affects the Smash Balloon Social Post Feed plugin before version 4.1.1, allowing potential attackers to exploit a reflected XSS vulnerability in the custom-facebook-feed on the cff-top admin page.
CVE-2021-25065 has a severity rating of medium, with a CVSS score of 5.4.
To fix CVE-2021-25065, you should update the Smash Balloon Social Post Feed plugin to version 4.1.1 or later.
The Common Weakness Enumeration (CWE) for CVE-2021-25065 is CWE-79, which represents an issue related to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').