Smash Balloon Social Photo Feed – Easy Social Feeds Plugin vulnerabilities

Product

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

by smub · last CVE Aug 5, 2026

CVEs

On KEV

5.4

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 3Low 0

Severity

Exploitation

Watch

Add Smash Balloon Social Photo Feed – Easy Social Feeds Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-4583	5.4	0%	May 29	Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute Affected: through 6.9.0
CVE-2026-15452	4.7	0%	Aug 5	Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String Affected: through 6.11.3
CVE-2026-12002	4.7	0%	Jul 8	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter Affected: through 6.11.1