CVE-2026-93756 describes a stored cross-site scripting vulnerability in the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin affecting all versions up to 4.13.0. The vulnerability arises from insufficient input sanitization and output escaping of Facebook comment messages rendered via v-html in the admin builder preview. Attackers can inject scripts that execute in administrator sessions without requiring WordPress credentials, leveraging Facebook comments on connected pages. The use of v-show instead of v-if causes injected HTML to be evaluated in the DOM even when not visible. Furthermore, a lack of URL validation in the cff_install_addon AJAX handler allows these scripts to trigger arbitrary plugin installations from attacker-controlled URLs, potentially leading to server-side code execution.

An unauthenticated attacker with a Facebook account can inject malicious scripts that execute in the context of an administrator's session when they view the feed builder preview. This can lead to arbitrary plugin installation and potentially server-side code execution, compromising the WordPress environment. The CVSS 3.1 score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with scope change.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid accessing the feed builder preview page or restrict access to trusted users only. Monitoring vendor channels for updates and applying official patches promptly when released is recommended.