CVE Database /
CVE-2026-16775
CVE · Medium
CVE-2026-16775 — Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.10.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-16775
|
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.10.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 4.10.0
|
4.10.0 |
2025-10-09 |
—
|
CVE-2026-16775
The Smash Balloon Social Post Feed plugin for WordPress contains a vulnerability that allows attackers with contributor-level access or higher to inject malicious scripts into pages. This is due to inadequate filtering of user input and failure to properly prevent the execution of user-submitted code. As a result, when a user accesses the affected page, the injected scripts will run, potentially leading to further security risks. The vulnerability affects all versions of the plugin up to and including 4.9.0.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings