CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

VulnCheck KEV: CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2021-24918

creationtimestamp| type| source ---|---|--- 2021-11-29 12:33:08+00:00| seen| https://t.me/cibsecurity/33016...

CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin, in versions before 4.0.1 , is vulnerable to a cross-site scripting (XSS) flaw due to a lack of privilege or nonce validation when saving plugin settings. This oversight allows any logged-in user on a vulnerable site to modify settings and injec...

CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...