Medium severity · published Aug 16, 2026
CVE-2026-16775
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress · smub
through 4.9.0 · source: vendor
Affected product
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
smub
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16775
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_FB_Settings.php#L59
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L1149
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L312
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3640517/custom-facebook-feed/trunk/inc/CFF_Shortcode.php?old=3465306&old_path=custom-facebook-feed%2Ftrunk%2Finc%2FCFF_Shortcode.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae039144-2c02-4a00-9fff-f4e90a6a8236?source=cve
More from Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
7.2
CVE-2026-93756
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
5.4
CVE-2025-4577
Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute