Plugin icon

Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

custom-facebook-feed

Vulnerabilities:

8

Last Updated:

March 12, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2025-10-09
Title
Smash Balloon Social Post Feed < 4.3.3 - Missing Authorization
Fixed in
Fixed in 4.3.3
CVSS
4.3 (medium)
Published
2025-06-09
Title
Smash Balloon Custom Facebook Feed < 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
Fixed in
Fixed in 4.3.2
CVSS
6.4 (medium)
Published
2024-04-10
Title
Smash Balloon Social Post Feed < 4.2.2 - Facebook Token Reset/Update via CSRF
Fixed in
Fixed in 4.2.2
CVSS
4.3 (medium)
Published
2022-12-20
Title
Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
Fixed in
Fixed in 4.1.6
CVSS
6.8 (medium)
Published
2021-12-16
Title
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.1.1
CVSS
4.8 (medium)
Published
2021-10-29
Title
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Fixed in
Fixed in 4.0.1
CVSS
7.3 (high)
Published
2021-08-16
Title
Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
Fixed in
Fixed in 2.19.2
CVSS
9.6 (critical)
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.19.2
CVSS
4.7 (medium)