The Smash Balloon Social Photo Feed plugin for WordPress contains an input‑validation flaw in the handling of the REQUEST_URI query string. The plugin fails to sanitize or escape user‑supplied data before rendering it in the page, allowing attackers to inject arbitrary HTML and JavaScript that is reflected back to the browser. When a victim clicks a specially crafted link, the injected script runs within the victim’s session, potentially compromising session cookies, cookies, or defacing the site.

All WordPress sites that use the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin with version 6.11.3 or earlier are affected. The plugin is available as a WordPress plugin and is installed on any site that requires social media feed functionality.

The CVSS score of 4.7 indicates moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that exploitation is currently low to moderate. The attack requires only a crafted URL that includes malicious content in the REQUEST_URI query string and convincing a user to click it; no authentication or other privileges are needed. The official fix is presumed to be an upgrade to the next release (6.12 or later), but that is inferred from version history and not explicitly stated in the advisory.