Smash Balloon Social Post Feed – Simple Social Feeds for WordPress vulnerabilities

Product

Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

by smub · last CVE Oct 2, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Severity mix

Critical 0High 1Medium 2Low 0

Severity

Exploitation

Watch

Add Smash Balloon Social Post Feed – Simple Social Feeds for WordPress to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-93756	7.2	0%	Oct 2	Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview Affected: through 4.13.0
CVE-2026-16775	6.4	0%	Aug 16	Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute Affected: through 4.9.0
CVE-2025-4577	5.4	0%	Jun 10	Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute Affected: through 4.3.1