PT-2021-16030 · Smash Balloon · Smash Balloon Social Post Feed

Dc11 · Published 2021-09-13 · Updated 2021-09-23 · CVE-2021-24508

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed WordPress plugin versions prior to 2.19.2

Description The issue concerns a Stored Cross-Site Scripting problem. It arises because the feedID POST parameter in the feed locator AJAX action is not properly sanitized or escaped before being output in the admin dashboard. This can be exploited by both authenticated and unauthenticated users, leading to the execution of malicious scripts in the context of a logged-in administrator.

Recommendations For Smash Balloon Social Post Feed WordPress plugin versions prior to 2.19.2, update to version 2.19.2 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24508

Affected Products

Smash Balloon Social Post Feed

References · 3

• 🔥 https://wpscan.com/vulnerability/2b543740-d4b0-49b5-a021-454a3a72162f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24508 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24508 · Vendor Advisory