Smash Balloon Social Post Feed < 4.14.0 - Unauthenticated Stored XSS via Facebook Comment Message

Description

The plugin is vulnerable to Stored Cross-Site Scripting via a Facebook comment message rendered through v-html in the admin feed builder preview, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator accesses the feed builder preview page; the attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed. The use of v-show rather than v-if means injected HTML, including onerror handlers, is evaluated in the DOM even when the comment section is not visually displayed. Combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.