Description

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T06:16:51.217Z",
  "pubdate": "2026-08-16T06:16:51.217Z",
  "executiveSummary": "The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability across all versions up to, and including, 4.9.0. This security flaw stems from inadequate input sanitization and output escaping mechanisms applied to the 'id' shortcode attribute. The vulnerability allows authenticated malicious actors possessing contributor-level access or higher to inject arbitrary web scripts and malicious payloads into web pages. When unsuspecting users or administrators access the compromised page containing the rendered shortcode, the injected script executes within the context of their browser session. This creates severe risk implications, including potential session hijacking, unauthorized administrative actions, defacement, or redirection to malicious external resources. Exploitation requires authenticated access with specific privilege thresholds, specifically a minimum of contributor-level capabilities within the WordPress environment, alongside user interaction in the form of visiting the injected page.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin to properly sanitize user-supplied input provided through the 'id' shortcode attribute and to safely escape output before rendering it within the Document Object Model (DOM).\nThe vulnerable component resides within the shortcode parsing and rendering logic of the plugin, affecting all software versions up to, and including, 4.9.0.\nAuthentication and privilege requirements dictate that an attacker must possess at least contributor-level access to the WordPress application. This level of privilege typically permits the creation and editing of posts or pages, providing the necessary vector to embed malicious shortcodes.\nNetwork exposure is inherent to web-based WordPress deployments, where pages containing the vulnerable shortcode are publicly accessible or accessible to authenticated users depending on the page visibility settings.\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor privileges crafts a malicious shortcode payload leveraging the 'id' attribute to inject arbitrary JavaScript or HTML tags. Second, the attacker embeds this shortcode within a post or page on the WordPress site. Third, the application processes the shortcode, failing to neutralize the malicious input due to insufficient sanitization. Fourth, the unescaped payload is stored persistently within the database. Finally, when a victim accesses the affected page, the browser parses the injected script and executes it within the user's session.\nPayload behavior involves executing arbitrary client-side code within the security context of the victim's browser session. The post-exploitation impact includes the potential theft of session cookies, execution of unauthorized actions on behalf of the victim, extraction of sensitive data, and further client-side compromise."
}