SM
Vendor
Smashballoon
13
CVEs
0
On KEV
0
New 30D
Products
CT8.8
Custom Twitter Feeds
Smashballoon
5 CVEs0 on KEV0 new
SB6.1
Smash Balloon Social Post Feed
Smashballoon
4 CVEs0 on KEV0 new
FF5.4
Feeds For Youtube
Smashballoon
2 CVEs0 on KEV0 new
RF4.3
Reviews Feed
Smashballoon
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-49685 | CT Custom Twitter Feeds Smashballoon | 8.8 | Oct 31 | WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-8983 | CT Custom Twitter Feeds Smashballoon | 4.8 | Oct 8 | Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS |
| CVE-2024-8199 | RF Reviews Feed Smashballoon | 4.3 | Aug 27 | Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update |
| CVE-2024-8200 | RF Reviews Feed Smashballoon | 4.3 | Aug 27 | Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery |
| CVE-2024-6256 | FF Feeds For Youtube Smashballoon | 5.4 | Jul 11 | Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
| CVE-2024-0379 | CT Custom Twitter Feeds Smashballoon | 4.3 | Feb 20 | Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update |
| CVE-2023-52136 | CT Custom Twitter Feeds Smashballoon | 8.8 | Jan 5 | WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2023-4841 | FF Feeds For Youtube Smashballoon | 5.4 | Sep 14 | Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2022-33974 | CT Custom Twitter Feeds Smashballoon | 8.8 | May 29 | WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2022-4477 | SB Smash Balloon Social Post Feed Smashballoon | 5.4 | Jan 16 | Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS |
| CVE-2021-25065 | SB Smash Balloon Social Post Feed Smashballoon | 5.4 | Jan 17 | Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS) |
| CVE-2021-24918 | SB Smash Balloon Social Post Feed Smashballoon | 5.4 | Nov 29 | The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting |
| CVE-2021-24508 | SB Smash Balloon Social Post Feed Smashballoon | 6.1 | Sep 13 | The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both… |