Skip to content
PluginCanary

Smash Balloon Social Post Feed

Smash Balloon Social Post Feed - Simple Social Feeds for WordPress
by Syed Balkhi · 100,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 17 releases in 24 months, no unpatched vulnerabilities.

90/ 100 Canary Score
Sub-scores for Smash Balloon Social Post Feed
Ownership100
Maintenance100
Security75
SupportNo data
Reputation85

How the score works

Quick answers

Is Smash Balloon Social Post Feed still maintained?
Yes. Last release 2 Nov 2026, 17 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Smash Balloon Social Post Feed, and has it changed hands?
No change recorded. Main committer Craig at Smash Balloon since Mar 2020. 4 Nov 2026 · SVN log
Was Smash Balloon Social Post Feed removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Smash Balloon Social Post Feed safe?
10 known vulnerabilities, all fixed (latest in 4.14.0). Not on the exploited list. 1 Oct 2026 · Wordfence Intelligence
Is the latest Smash Balloon Social Post Feed update safe to install?
No ownership change before 4.15.1. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
smashballoon8 Jun 2013 to 28 Mar 2022, 604 commits
Craig at Smash Balloon27 Mar 2020 to 5 Nov 2024, 32 commits
nabilsmashballoon2 Jan 2024 to 19 Feb 2026, 10 commits
AhmedGeek23 Apr 2025 to 10 Sep 2026, 17 commits
alexopen28 Aug 2026 to 2 Nov 2026, 7 commits

New committer alexopen made a first commit on 28 Aug 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
17
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Smash Balloon Social Post Feed
Q1 20243
Q2 20242
Q3 20240
Q4 20241
Q1 20251
Q2 20252
Q3 20250
Q4 20252
Q1 20262
Q2 20262
Q3 20265
Q4 20262

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (4 reviews). Lifetime: 4.7.

Average rating per quarter for Smash Balloon Social Post Feed
Q1 20255.0
Q2 20253.5
Q3 20253.5
Q4 20254.0
Q1 20264.3
Q2 20265.0
Q3 20264.6
Q4 20265.0

Average rating stayed at 5.0 between Q1 2025 and Q4 2026.

Rating distribution
5 star1367
4 star45
3 star20
2 star15
1 star64
Latest low reviews

Security record

4 vulnerabilities in 24 months (10 on record), all patched (latest fixed in 4.14.0).

Show 10 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
1 Oct 2026Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview7.2<= 4.13.04.14.0Patched before disclosure
15 Aug 2026Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4<= 4.9.04.10.0Patched before disclosure
9 Oct 2025Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization4.3<= 4.3.24.3.3Patched before disclosure
9 Jun 2025Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute6.4<= 4.3.14.3.2Patched before disclosure
10 Apr 2024Smash Balloon Social Post Feed <= 4.2.1 - Cross-Site Request Forgery4.3<= 4.2.14.2.2Patched before disclosure
20 Dec 2022Smash Balloon Social Post Feed <= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.1.54.1.6Patched before disclosure
16 Dec 2021Smash Balloon Social Post Feed <= 4.1 - Reflected Cross-Site Scripting5.4< 4.1.14.1.1Patched before disclosure
29 Oct 2021Smash Balloon Social Post Feed <= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting5.4< 4.0.14.0.1Patched before disclosure
16 Aug 2021Smash Balloon Social Post Feed <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting6.1< 2.19.22.19.2Patched before disclosure
20 Jul 2021Smash Balloon Plugins (Various Versions) - Reflected Cross-Site Scripting6.1<= 2.19.12.19.2Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

50% of 2 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Smash Balloon Social Post Feed
4 May 20262,105
11 May 202674,649
18 May 202625,953
25 May 202612,036
1 Jun 20269,307
8 Jun 202675,442
15 Jun 202616,330
22 Jun 202610,690
29 Jun 20269,517
6 Jul 202615,929
13 Jul 20267,560
20 Jul 202676,746
27 Jul 202616,283
3 Aug 202619,514
10 Aug 202690,795
17 Aug 202696,567
24 Aug 202619,261
31 Aug 202612,745
7 Sep 202676,763
14 Sep 202623,418
21 Sep 202614,026
28 Sep 202682,597
5 Oct 202625,657
12 Oct 20269,410
19 Oct 202613,479
26 Oct 202679,446
2 Nov 202620,187

Weekly downloads over the last 4 weeks are 12% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

SocialFeedsScore 100 · 40,000+Social LikeBox & FeedScore 100 · 10,000+ButtonizerScore 98 · 40,000+Feed Them SocialScore 97 · 20,000+WPZOOM Social Feed Widget & BlockScore 96 · 50,000+

Facts

Version4.15.1
AuthorSyed Balkhi
Added8 Jun 2013
Last updated2 Nov 2026
Active installs100,000+
Requires WordPress4.1
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsfacebook, facebook feed, Facebook Page, Facebook posts, Facebook account

Other plugins by this author: WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More, WP Mail SMTP by WPForms - SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More, WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager, All in One SEO - AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights), Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More, Popup Builder & Popup Maker for WordPress - OptinMonster Email Marketing and Lead Generation, One Click Demo Import, Smash Balloon Social Photo Feed - Easy Social Feeds Plugin, Easy WP SMTP - WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more, Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery, WP Mail Logging, WP Crontrol

Questions

Is Smash Balloon Social Post Feed still maintained?

Yes. Last release 2 Nov 2026, 17 releases in the last 24 months.

Who owns Smash Balloon Social Post Feed, and has it changed hands?

No change recorded. Main committer Craig at Smash Balloon since Mar 2020.

Was Smash Balloon Social Post Feed removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Smash Balloon Social Post Feed safe?

10 known vulnerabilities, all fixed (latest in 4.14.0). Not on the exploited list.

Is the latest Smash Balloon Social Post Feed update safe to install?

No ownership change before 4.15.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue