CVE-2025-4583

CVE-2025-4583 affects the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw in the data-plugin attribute present in all versions up to 6.9.0, exploitable by authenticated attackers with Contributor-level access and ab...

WordPress plugin Smash Balloon Social Photo Feed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Smash Balloon Social Photo Feed plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping...

PT-2025-23140 · WordPress · Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

Name of the Vulnerable Software and Affected Versions: The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress versions up to, and including, 6.9.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output...

CVE-2024-49685

Cross-Site Request Forgery CSRF vulnerability in Syed Balkhi Custom Twitter Feeds Tweets Widget custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds Tweets Widget: from n/a through = 2.2.3...

CVE-2024-31379

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1...

CVE-2023-52136

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

CVE-2022-33974

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget plugin = 1.8.4 versions...

CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2021-25065

The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page...

CVE-2024-49685

Cross-Site Request Forgery CSRF vulnerability in Syed Balkhi Custom Twitter Feeds Tweets Widget custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds Tweets Widget: from n/a through = 2.2.3...

CVE-2024-49685

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds Tweets Widget: from n/a through 2.2.3...

CVE-2024-49685

CVE-2024-49685 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin for WordPress, affecting versions up to 2.2.3. The issue enables CSRF without requiring authentication and is exploitable in affected environments, potential...

CVE-2024-49685 WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Syed Balkhi Custom Twitter Feeds Tweets Widget custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds Tweets Widget: from n/a through = 2.2.3...

PT-2024-33638 · Smash Balloon · Smash Balloon Custom Twitter Feeds

Name of the Vulnerable Software and Affected Versions: Smash Balloon Custom Twitter Feeds Tweets Widget versions through 2.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into...

CVE-2024-31379

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1...

CVE-2024-31379

CVE-2024-31379: CSRF in Smash Balloon Social Post Feed plugin (WordPress). Affected: Smash Balloon Social Post Feed 4.2.1 and earlier. ROOT CAUSE/IMPACT details are not expanded in the provided documents beyond the CSRF classification; no patch/version remediation is specified in the supplied data.

CVE-2024-31379 WordPress Smash Balloon Social Post Feed plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1...

CVE-2024-31379 WordPress Smash Balloon Social Post Feed plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1...

WordPress Plugin Smash Balloon Social Post Feed 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Smash Balloon Social Post Feed A...

PT-2024-24025 · Smash Balloon · Smash Balloon Social Post Feed

Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed versions through 4.2.1 Description: A Cross-Site Request Forgery CSRF issue affects the Smash Balloon Social Post Feed. This type of issue allows an attacker to perform unintended actions on a web application th...