CVE-2022-4477

The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in...

CVE-2022-4477 Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in...

CVE-2022-4477

The CVE-2022-4477 entry concerns the WordPress plugin Smash Balloon Social Post Feed (before 4.1.6). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by incomplete validation/escaping of shortcode attributes, allowing a low-privilege user (contributor) to inject scripts that a...