CVE-2025-49937
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Smash Balloon Social Post Feed plugin by Syed Balkhi is vulnerable to Missing Authorization in versions from n/a through 4.3.2. This issue allows exploiting incorrectly configured access control security levels.
Risk Assessment
The risk involves unauthorized access to plugin functions, potentially leading to data privacy breaches or unwanted settings changes.
Recommendation
Update the plugin to a patched version and verify permission configurations.
Other vulnerabilities in Smash Balloon Social Post Feed
See all- CVE-2026-93756High
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
- CVE-2026-16775Medium
The Smash Balloon Social Post Feed – Simple Social Feeds plugin for WordPress up to version 4.9.0 is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page.
Original NVD description (English source)
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS