smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

• CVE-2026-15452 Medium 4.7 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String 0.4%
• CVE-2026-12002 Medium 4.7 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter 0.1%
• CVE-2025-4583 Medium 5.4 Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute 0.2%