The vulnerability allows an authenticated user with contributor-level privileges to insert malicious scripts via the 'id' attribute of a shortcode. When the page containing the shortcode is rendered, the injected script executes in the browser context of any visitor, thereby enabling the attacker to steal session cookies, deface content, or redirect users. The weakness is a classic stored XSS flaw (CWE‑79) that compromises confidentiality and integrity of user data and disrupts the user experience.

The affected product is the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin. All releases up to and including version 4.9.0 are vulnerable, regardless of the WordPress installation or hosting environment. Authentication is required, but any user assigned the Contributor role or higher can exploit the flaw by adding or editing a shortcode that contains a crafted 'id' value.

The CVSS score of 6.4 indicates a moderate severity, but the lack of publicly available EPSS data means the exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation at scale. As the flaw requires authenticated access, attackers must first compromise a user account with contributor privileges or higher. Once authenticated, they can inject scripts that will run for all visitors who view the affected page. The impact can be mitigated only by removing the vulnerability through a patch or by ensuring the shortcode is not used by untrusted users.