CVE-2014-4528: Fbpromotions Project Fbpromotions

Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.

Affected products

• Fbpromotions Project Fbpromotions: up to and including 1.3.4

Published 2014-07-01. Last modified 2026-06-17.