https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:18:15.283875+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-24508 CVE-2021-24508 — Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS 2026-10-08T06:18:15.285189+00:00

Affected: Unknown Smash Balloon Social Post Feed

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.