PLUGIN SECURITY
Is Custom Facebook Feed safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Custom Facebook Feed WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
custom-facebook-feed - Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.1.1 [CVE-2021-25065, WordPress Smash Balloon Social Post Feed plugin <= 4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability, Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS), Smash Balloon Social Post Feed <= 4.1 - Reflected Cross-Site Scripting]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.0.1 [CVE-2021-24918, WordPress Smash Balloon Social Post Feed plugin <= 4.0 - Stored Cross-Site Scripting (XSS) via Arbitrary Setting Update vulnerability, Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS, Smash Balloon Social Post Feed <= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 2.19.2 [CVE-2021-24508, WordPress Smash Balloon Social Post Feed plugin <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability, Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS, Smash Balloon Social Post Feed <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.1.6 [CVE-2022-4477, WordPress Smash Balloon Social Post Feed Plugin < 4.1.6 is vulnerable to Cross Site Scripting (XSS), Smash Balloon Social Post Feed <= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting, Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 2.19.2 [Smash Balloon Plugins (Various Versions) - Reflected Cross-Site Scripting]
+ 3 more known vulnerabilities
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.2.2 [CVE-2024-31379, WordPress Smash Balloon Social Post Feed Plugin <= 4.2.1 is vulnerable to Cross Site Request Forgery (CSRF), Smash Balloon Social Post Feed <= 4.2.1 - Cross-Site Request Forgery]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.3.2 [CVE-2025-4577, WordPress Smash Balloon Social Post Feed Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS), Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute, EUVD-2025-17658]
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.3.3 [CVE-2025-49937, Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Meta for WooCommerce — 400000+ active installs — max PHP 8.4
- Meta pixel for WordPress — 400000+ active installs
- Nextend Social Login and Register — 200000+ active installs — max PHP <8.0
- Metricool – Social media and site statistics — 80000+ active installs
- Facebook Chat Plugin – Live Chat Plugin for WordPress — 80000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.