CVE-2026-16775

CVE-2026-16775 is a stored XSS in the Smash Balloon Social Photo Feed plugin (versions through 4.9.0), affecting the 'id' shortcode attribute. The CVSS 6.4 (medium) rating reflects a contributor-level access prerequisite, but the EPSS probability of 0.00193 is conspicuously low — and that gap is the actual analytical puzzle, not the severity score itself. The contributor barrier is real but overrated as a defensive moat: these accounts target editorial staff who are routinely phished, subjected to credential stuffing, or compromised through supply-chain attacks on other plugins. A single compromised contributor can inject persistent scripts into every page rendering that shortcode — and Smash Balloon's social feed shortcodes typically appear on public-facing, high-traffic pages designed for visitor engagement. The EPSS likely measures current attacker awareness, not inherent difficulty. Smash Balloon has had prior CVEs, placing it in existing enumeration tooling. The specific 'id' shortcode attribute is obscure enough that no reliable PoC has circulated yet — but the WordPress plugin ecosystem has a documented pattern where obscure attack surfaces stay low-EPSS only until a researcher bothers to map them. The disclosed-but-unfixed window is the danger phase: auto-update adoption in the WordPress plugin ecosystem is structurally low, meaning many sites running this plugin will remain vulnerable for weeks or months after a patch exists. Treat this as a priority patch regardless of the EPSS number — the low score reflects market inefficiency, not your actual exposure. Verify your installed version, check for contributor-level accounts you didn't provision, and monitor your site for unusual shortcode configurations in post content.

Reviewed through automated stages and approved by a human before publication.