CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

VulnCheck KEV: CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2021-24918

creationtimestamp| type| source ---|---|--- 2021-11-29 12:33:08+00:00| seen| https://t.me/cibsecurity/33016...

CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2021-24918

CVE-2021-24918 affects the WordPress plugin Smash Balloon Social Post Feed (versions before 4.0.1). The root cause is missing privilege and nonce validation when saving plugin settings, allowing any logged-in user on a vulnerable site to update settings and store rogue JavaScript on posts and pag...