Stored Cross-Site Scripting Vulnerability in Smash Balloon Social Post Feed Plugin for WordPress
CVE-2025-4577
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 June 2025
What is CVE-2025-4577?
The Smash Balloon Social Post Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate sanitization and escaping of the data-color attribute. This flaw affects all versions up to and including 4.3.1, allowing authenticated users with Contributor-level permissions or higher to inject malicious scripts within web pages. These scripts execute upon user access to the affected pages, posing a risk of unauthorized actions and data exposure.
Affected Version(s)
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress * <= 4.3.1