CVE-2026-15452 is a reflected cross-site scripting vulnerability (CWE-79) in the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically via the REQUEST_URI query string. This allows unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser if the victim clicks a crafted link. The vulnerability affects all plugin versions up to and including 6.11.3. No official patch or remediation level has been provided in the available data.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The attack requires user interaction (clicking a malicious link) and has a medium impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links and consider disabling or removing the affected plugin version. Monitor vendor channels for updates and apply patches promptly once released.