Smash Balloon — Vulnerabilities & Security Advisories 3

Smash Balloon develops social media feed plugins that allow websites to display content from platforms like Instagram, Facebook, and YouTube. Historically, the plugin has been susceptible to multiple cross-site scripting (XSS) vulnerabilities, including stored XSS that could allow attackers to inject malicious scripts into user browsers. One critical vulnerability (CVE-2021-24966) enabled remote code execution through unauthenticated REST API endpoints. The plugin's extensive user base and direct integration with social platforms make it a high-impact target. While recent versions have addressed many issues, the plugin's complex functionality and frequent updates continue to present potential security risks that require careful configuration and maintenance.