CVE-2026-93756 in Social Post Feed Plugin
Summary
by MITRE • 10/02/2026
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Smash Balloon Social Post Feed for WordPress represents a critical security flaw rooted in insufficient input sanitization and output escaping within the Admin Builder Preview functionality. This Stored Cross-Site Scripting (XSS) vector allows unauthenticated attackers to inject arbitrary web scripts into the application environment. The attack surface is particularly dangerous because it does not require valid WordPress credentials, relying instead on an attacker possessing a Facebook account capable of posting comments on a connected Facebook Page. When such a comment containing malicious script tags or event handlers like onerror is posted, it is stored within the system and subsequently rendered by the plugin's frontend framework during administrative operations.
The technical mechanism behind this exploitation involves the use of Vue.js rendering directives, specifically v-html, which interprets string content as HTML rather than plain text. This directive bypasses standard browser security measures that typically prevent script execution in static contexts. Furthermore, the implementation utilizes v-show instead of v-if for conditional visibility control. Unlike v-if, which removes elements from the DOM when hidden, v-show merely toggles CSS display properties while keeping the element and its associated event handlers active within the Document Object Model. Consequently, even if the comment section is visually collapsed or not displayed to the user, any injected HTML containing executable code remains in memory and can be triggered by specific interactions or browser parsing behaviors, such as image loading failures triggering onerror handlers.
The impact of this vulnerability extends beyond simple session hijacking or defacement due to a secondary flaw within the cff_install_addon AJAX handler located in admin/addon-functions.php. This component lacks proper URL validation for external resources requested during plugin installation processes. When an attacker successfully executes arbitrary scripts via the XSS vector, they can leverage the administrator's active session and elevated privileges to invoke this endpoint with malicious parameters. By supplying a crafted URL pointing to a server controlled by the attacker, the script can force the WordPress instance to download and install a rogue plugin or extension. This chain of exploitation transforms a client-side scripting issue into a severe server-side compromise, potentially leading to full remote code execution on the hosting environment.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. The specific technique of using v-html for untrusted data falls under CWE-80, while the lack of URL validation in the AJAX handler corresponds to CWE-621, Excretion Error Buffer Overflow, or more accurately CWE-94, Improper Control of Generation of Code, though it is primarily a case of CWE-732, Incorrect Permission Assignment for Critical Resource. In terms of attack taxonomy, this scenario maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through the use of web browser scripting languages like JavaScript. The initial access vector via social media integration represents a form of supply chain or third-party dependency risk, often categorized under T1189, Drive-by Compromise, if viewed from the perspective of the attacker's infrastructure delivering the payload.
Mitigation strategies must address both the immediate code flaws and broader architectural weaknesses. Immediate remediation involves updating to a patched version of the Smash Balloon Social Post Feed plugin where input sanitization is enforced using functions like wp_kses_post or similar WordPress standards-compliant escaping mechanisms before data reaches v-html directives. Developers should also replace v-show with v-if for dynamic components containing untrusted content to ensure that malicious elements are completely removed from the DOM when not in use, thereby preventing hidden event handler execution. Additionally, strict URL validation and allowlisting must be implemented within the cff_install_addon AJAX handler to prevent arbitrary file downloads or plugin installations from external sources. Administrators should also consider implementing Content Security Policy headers where feasible to restrict script execution origins, although this is often challenging in complex WordPress ecosystems with many plugins relying on inline scripts. Regular security audits and penetration testing focused on third-party integrations are essential to identify similar vulnerabilities before they can be exploited by malicious actors seeking server-side access through client-side entry points.