CVE-2021-24918

CVE-2021-24918 affects the WordPress plugin Smash Balloon Social Post Feed (versions before 4.0.1). The root cause is missing privilege and nonce validation when saving plugin settings, allowing any logged-in user on a vulnerable site to update settings and store rogue JavaScript on posts and pag...

CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

PT-2021-16367

Name of the Vulnerable Software and Affected Versions: Smash Balloon Social Post Feed WordPress plugin versions prior to 4.0.1 Description: The issue allows any logged-in user on a vulnerable site to update the plugin's settings without proper privilege or nonce validation. This enables the stora...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...

Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The plugin did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

WordPress Smash Balloon Social Post Feed Plugin < 2.19.2 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2021-24508

The issue CVE-2021-24508 concerns the Smash Balloon Social Post Feed WordPress plugin prior to version 2.19.2. The vulnerability arises because the feed_locator AJAX action does not sanitize or escape the POST parameter feedID, and the truncated value is output in the admin dashboard. This leads ...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Smash Balloon Social Post Feed, which...

CVE-2021-20617

creationtimestamp| type| source ---|---|--- 2021-01-14 16:49:36+00:00| seen| https://t.me/cibsecurity/22152 2023-02-19 21:50:11+00:00| published-proof-of-concept| Telegram/o9jdQwy18DMsF99wo6Zn2RTKWm1b295QBP4XE2j0Ry8AZi0 2023-10-29 19:15:00+00:00| seen| https://t.me/CyberSecurityTechnologies/7778...

CVE-2020-36847

creationtimestamp| type| source ---|---|--- 2020-12-03 16:03:35+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wpsimplefilelistrce.rb 2025-07-13 21:02:21+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lturhz35mw22 2025-07-...

10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

WordPress 10Web Social Post Feed plugin <= 1.1.26 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Vu Tien Hoa SunCSR in WordPress 10Web Social Post Feed plugin versions = 1.1.26. Solution Update the WordPress 10Web Social Post Feed plugin to the latest available version at least 1.1.27...

10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. PoC https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

CVE-2019-13101

creationtimestamp| type| source ---|---|--- 2020-05-12 13:27:31+00:00| seen| https://t.me/Ninjutsuos/134 2020-05-12 13:27:34+00:00| seen| https://t.me/Ninjutsuos/739 2020-08-27 17:04:45+00:00| seen| https://t.me/Ninjutsuos/6563 2020-08-27 17:04:45+00:00| seen| https://t.me/Ninjutsuos/343 2025-08-...

CVE-2019-13354

creationtimestamp| type| source ---|---|--- 2019-07-08 16:59:52+00:00| seen| https://t.me/cveNotify/304 2025-10-13 09:09:58+00:00| seen| https://bsky.app/profile/parlaconguido.bsky.social/post/3m32uktwdym26 2026-08-02 17:00:05+00:00| published-proof-of-concept| https://t.me/nuancesprognews/339...

CVE-2018-8595

creationtimestamp| type| source ---|---|--- 2019-02-01 12:53:41+00:00| seen| MISP/5c543c87-503c-4622-a292-0aa6ac12042b 2020-10-09 15:53:03+00:00| seen| MISP/0b0f374b-39b1-4229-891b-2defd31fe736 2025-01-28 21:01:59+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lgte2h47mv2r...

CVE-2009-20008

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/greendamurl.rb 2025-08-30 18:39:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxn7us22ht27 2025-10-23...

CVE-2010-1173

creationtimestamp| type| source ---|---|--- 2010-08-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14594 2026-02-12 21:03:07+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3meovcbyi7n27...