CVE-2026-15452 is a reflected cross-site scripting vulnerability in the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the REQUEST_URI query string. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim clicks a crafted link. The vulnerability affects all plugin versions up to and including 6.11.3.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. The vulnerability requires user interaction (clicking a malicious link) and has a medium severity with a CVSS score of 4.7. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with links and consider disabling or limiting the use of the affected plugin. Monitor official vendor channels for updates and apply patches promptly once released.