What is the CVSS score of CVE-2026-16775?

CVE-2026-16775 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Smash Balloon Social Post Feed CVE-2026-16775

EUVD-2026-59901 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-g8j2-ph9r-rqvm

WordPress XSS Wordpress Plugin Smash Balloon Social Post Feed Simple Social Feeds For Wordpress Smub

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory contributor authentication; UI:R corrects the NVD vector since a victim must visit the injected page for execution; S:C and C:L/I:L reflect cross-session script execution impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:20 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Smash Balloon Social Post Feed - Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.

Technical ContextAI

The vulnerability is rooted in the plugin's shortcode processing layer - specifically within CFF_Shortcode.php (lines 312 and 1149) and CFF_FB_Settings.php (line 59), as identified by the WordPress plugin Trac references. WordPress shortcodes are server-rendered constructs whose attribute values are parsed and echoed into page HTML; when those values are not sanitized on input and escaped on output, they become direct XSS sinks. CWE-79 (Improper Neutralization of Input During Web Page Generation) precisely describes this root cause: the 'id' attribute value accepted by the plugin's shortcode handler is reflected into rendered HTML without adequate escaping, allowing HTML/script injection. The affected CPE is cpe:2.3:a:smub:smash_balloon_social_post_feed_-_simple_social_feeds_for_wordpress:*:*:*:*:*:*:*:*, covering all versions up to and including 4.9.0.

RemediationAI

Update the Smash Balloon Social Post Feed plugin to a version beyond 4.9.0 - a fix has been committed to trunk (changeset 3640517, visible at plugins.trac.wordpress.org/changeset/3640517). Before deploying, verify the exact patched version number in the WordPress plugin changelog or repository tags, as the specific release version is not confirmed from provided input data. As an interim compensating control, restrict the WordPress Contributor role to explicitly trusted, verified users and audit the site's user list for unauthorized or low-trust contributor accounts; this reduces the attacker pool but does not eliminate the vulnerability. A Web Application Firewall rule filtering script tags and JavaScript event handler patterns within shortcode attribute values can provide additional defense-in-depth, with the trade-off of potential false positives on legitimate shortcode usage. Disabling the plugin entirely is the strongest workaround if the social feed functionality is non-essential.