Medium severity · published Jan 16, 2023
CVE-2022-4477
Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Smash Balloon Social Post Feed ·
before 4.1.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4477
Exploit
https://wpscan.com/vulnerability/c32a4c58-9f2b-4afa-9a21-4b4a5c4c4c41
More from Smash Balloon Social Post Feed
5.4
CVE-2021-25065
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
5.4
CVE-2021-24918
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS