CVE-2021-24508

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
15.8%
top 5.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Smash Balloon Social Post FeedSmashballoon Smash Balloon Social Post Feed
Timeline
PublishedSep 13
Latest updateMay 24

Description

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/smash_balloon_social_post_feed2.19.2 — 2.19.2

🔴Vulnerability Details

2
GHSA
GHSA-h2xq-fv4r-5784: The Smash Balloon Social Post Feed WordPress plugin before 2↗2022-05-24
▶
CVEList
Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS↗2021-09-13
▶
CVE-2021-24508 (MEDIUM CVSS 6.1) | The Smash Balloon Social Post Feed | cvebase.io