smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

• CVE-2026-93756 High 7.2 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview 0.3%
• CVE-2026-16775 Medium 6.4 Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute 0.3%
• CVE-2025-4577 Medium 6.4 Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute 0.3%