CVE-2026-16775

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed versions prior to 4.9.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the id shortcode attribute. These scripts execute whenever a user visits the affected page.

Recommendations Update the plugin to a version later than 4.9.0. Restrict the use of the id shortcode attribute for users with contributor-level access until the update is applied.