Threats tagged 'ghsa-rqhq-6w5v-rw72'

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 6.11.3. This vulnerability arises from insufficient input sanitization and output escaping of the REQUEST_URI query string, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The vulnerability has a medium severity rating with a CVSS score of 4.7.