Smash Balloon Social Post Feed Authenticated Stored XSS (CVE-2026-16775) Advisory

Vulnerability Overview Vulnerability Name: Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CVE ID: CVE-2026-16775 CVSS Score: 6.4 (Medium) Published Date: August 15, 2026 Last Updated: August 16, 2026 Researchers: Wordfence PRISM - Wordfence Affected Versions Affected Versions: <= 4.9.0 Fixed Version: 4.10.0 Plugin Name: Smash Balloon Social Post Feed – Simple Social Feeds for WordPress Plugin Type: Plugin Plugin Alias: custom-facebook-feed Remediation Remediation Measure: Upgrade to version 4.10.0 or later. Additional Information Vulnerability Description: This vulnerability allows authenticated attackers (with Contributor role or higher) to inject arbitrary web scripts via the 'id' shortcode attribute, enabling the execution of malicious scripts when users visit the injected page. References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization - CVE ID: CVE-2025-49937 - CVSS Score: 4.3 - Researcher: Legion Hunter - Published Date: October 9, 2025 Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-color Attribute - CVE ID: CVE-2025-4577 - CVSS Score: 6.4 - Researcher: Asaf Mozes - Published Date: June 9, 2025 Smash Balloon Social Post Feed <= 4.2.1 - Cross-Site Request Forgery - CVE ID: CVE-2024-31379 - CVSS Score: 4.3 - Researcher: Majed Refae - Published Date: April 10, 2024 Smash Balloon Social Post Feed <= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2022-4477 - CVSS Score: 6.4 - Researcher: István Márton - Published Date: December 20, 2022 Smash Balloon Social Post Feed <= 4.1 - Reflected Cross-Site Scripting - CVE ID: CVE-2021-25065 - CVSS Score: 5.4 - Researcher: Krzysztof Zając - Published Date: December 16, 2021 Smash Balloon Social Post Feed <= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting - CVE ID: CVE-2021-24918 - CVSS Score: 5.4 - Researcher: Marc-Alexandre Montpas - Published Date: October 29, 2021 Smash Balloon Social Post Feed <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting - CVE ID: CVE-2021-24508 - CVSS Score: 6.1 - Researcher: dc11 - Published Date: August 16, 2021 Smash Balloon Plugins (Various Versions) - Reflected Cross-Site Scripting - CVE ID: CVE-2021-24508 - CVSS Score: 6.1 - Researcher: WPScanTeam - Published Date: July 20, 2021 Summary This vulnerability involves a stored cross-site scripting (XSS) attack in the Smash Balloon Social Post Feed plugin, affecting versions 4.9.0 and earlier. It is recommended that users upgrade to version 4.10.0 or later as soon as possible to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Smash Balloon Social Post Feed Authenticated Stored XSS (CVE-2026-16775) Advisory

More from this source