CVE-2021-24508 Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS

2021-09-1317:56:20

CWE-79

WPScan

www.cve.org

vulnerability

unauthenticated stored xss

wordpress plugin

EPSS

0.002

Percentile

54.9%

JSON

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.

CNA Affected

[
  {
    "product": "Smash Balloon Social Post Feed",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.19.2",
        "status": "affected",
        "version": "2.19.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/2b543740-d4b0-49b5-a021-454a3a72162f

EPSS

0.002

Percentile

54.9%

JSON

Related for CVELIST:CVE-2021-24508