Input validation vulnerability in Smash Balloon Social Post Feed – Simple Social Feeds for WordPress 4.3.1

The Smash Balloon Social Post Feed plugin for WordPress is not completely secure. This is because it does not properly clean and protect the data-color attribute, which can lead to a type of hacking called Stored Cross-Site Scripting. This allows people with certain levels of access to the website to insert harmful code into pages, which can then be executed when someone visits that page.