CVE-2026-16775 is a stored Cross-Site Scripting vulnerability in the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin. The flaw exists in the handling of the 'id' shortcode attribute, where input is not properly sanitized or escaped before being rendered in web pages. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the infected pages. This affects all plugin versions up to and including 4.9.0.

Successful exploitation allows an attacker with contributor-level access to execute arbitrary scripts in the browsers of users who view the injected content. This can lead to session hijacking, defacement, or other malicious actions within the context of the affected site. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling the vulnerable shortcode if possible. Monitor vendor channels for updates and apply patches promptly once released.