Lucene search
WPScanCVELIST:CVE-2022-4477HistoryJan 16, 2023 - 3:38 p.m.
CVE-2022-4477 Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
2023-01-1615:38:01
WPScan
www.cve.org
cve-2022-4477; smash balloon; stored xss; wordpress plugin; cross-site scripting; admins
EPSS
0.001
Percentile
25.4%
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Smash Balloon Social Post Feed",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "4.1.6"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
openvas
openvas
WordPress Smash Balloon Social Post Feed Plugin < 4.1.6 XSS Vulnerability
2023-01-17 00:00:00
prion
prion
Cross site scripting
2023-01-16 16:15:00
nvd
nvd
CVE-2022-4477
2023-01-16 16:15:12
cve
cve
CVE-2022-4477
2023-01-16 16:15:12