CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects WordPress, Java.
CVE
CVE-2021-24918
Severity
MEDIUM
CVSS
5.4
EPSS
0.65%
WordPress Java
Original NVD Description
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Related CVEs
Other vulnerabilities affecting the same vendor(s)