The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin contains a stored cross‑site scripting flaw. The vulnerability resides in the data‑plugin attribute, which is not sanitized or escaped when saved. An authenticated Contributor or higher can inject arbitrary JavaScript that will run in the browsers of any user who views a page where the plugin renders. The attack allows the execution of malicious scripts, potentially leading to defacement, theft of session cookies, or further intrusion, as defined by CWE‑79.

Vendors and products affected include Smash Balloon’s Instagram Feed Free and Pro plugins. All installations of the Free plugin version 6.9.0 or earlier, and the Pro plugin version 6.8.0 or earlier, on WordPress sites are vulnerable. Any WordPress owner who has these plugin versions installed and who has users with Contributor‑level or higher privileges is at risk.

The CVSS base score of 5.4 indicates a moderate severity. The EPSS score of less than 1 percent shows a low probability of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, successful exploitation requires an account with Contributor role or higher, which is commonly granted to content editors. The attacker can inject scripts into the data‑plugin attribute, which will execute automatically when other users load affected pages, providing a persistence mechanism. Given the moderate score and low exploitation probability, site administrators should treat this as a medium‑risk threat that warrants timely remediation.