Input validation vulnerability in Smash Balloon Social Photo Feed 1.4.6.2

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to a type of attack known as Stored Cross-Site Scripting. This attack can be launched via Cross-Site Request Forgery on the settings page of the plugin. This attack is possible because of insufficient security measures in versions of the plugin up to and including version 1.4.6.2. Without the proper security measures in place, attackers who are authenticated can inject malicious web scripts in pages which will be executed whenever an unsuspecting user accesses the page.