Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93756 · Microsoft / collected KEV context

cve-program · CVE-2026-93756

• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a3bc4b-bc0c-47ac-9f60-e05b300311b4?source=cve
• https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Integrations/CFF_Graph_Url.php#L76
• https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L805
• https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/builder/templates/preview/preview-components.php#L142
• https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/inc/Builder/CFF_Feed_Builder.php#L242
• https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.12.0/admin/addon-functions.php#L142
• https://plugins.trac.wordpress.org/changeset/3720826/custom-facebook-feed/trunk/admin/builder/templates/preview/preview-components.php?old=3656491&old_path=custom-facebook-feed%2Ftrunk%2Fadmin%2Fbuilder%2Ftemplates%2Fpreview%2Fpreview-components.php

No related operational record is retained in the current change model.