The Smash Balloon Social Post Feed plugin for WordPress is vulnerable to stored cross‑site scripting because the data‑color attribute is not properly sanitized or escaped when saved. An authenticated user with Contributor or higher access can inject arbitrary JavaScript into the stored value. When a page containing the data‑color attribute is rendered, the injected script runs in the context of the visitor’s browser.

All releases of the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin up to and including version 4.3.1 are affected. The flaw exists in the plugin’s JavaScript files that render the feed and can be exploited via the plugin’s settings interface on any WordPress site that has the vulnerable plugin installed.

The CVSS score of 6.4 indicates moderate risk, while the EPSS score is below 1%, suggesting a low probability of current exploitation. The flaw requires only Contributor‑level authentication, which is common on many sites, so the attack surface is broad. If exploited, an attacker could run scripts that steal session cookies, deface content, or perform other client‑side attacks, though the vulnerability is not listed in KEV and no public exploits are known.