Security Issues Patched in Smash Balloon Social Post Feed Plugin

Marc Montpas posted: " During an internal audit of the Smash Balloon Social Post Feed plugin (also known as Custom Facebook Feed), we discovered several sensitive AJAX endpoints were accessible to any users with an account on the vulnerable site, like subscribers. Some of thes" New post on Jetpack Security Issues Patched in Smash Balloon Social Post Feed Plugin by Marc Montpas During an internal audit of the Smash Balloon Social Post Feed plugin (also known as Custom Facebook Feed), we discovered several sensitive AJAX endpoints were accessible to any users with an account on the vulnerable site, like subscribers. Some of these endpoints could enable Stored Cross-Site Scripting (XSS) attacks to occur.  A successful Stored XSS attack could enable bad actors to store malicious scripts on every post and page of the affected site. If a logged-in administrator visits one of the affected URLs, the script may run on their browser and execute administrative actions on their behalf, like creating new administrators and installing rogue plugins. We reported the vulnerabilities to this plugin's author via email, and they recently released version 4.0.1 to address them. We strongly recommend that you update to the latest version of the Smash Balloon Social Post Feed plugin and have an established security solution on your site, such as Jetpack Security. Read more of this post Marc Montpas | October 29, 2021 at 9:12 am | Tags: Jetpack, Security, Vulnerabilities | Categories: Security, Vulnerabilities | URL: https://wp.me/p1moTy-zaU Unsubscribe to no longer receive posts from Jetpack. Change your email settings at Manage Subscriptions. Trouble clicking? Copy and paste this URL into your browser: http://jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-social-post-feed-plugin/ Thanks for flying with WordPress.com