Plugin icon

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

instagram-feed

Vulnerabilities:

5

Last Updated:

December 11, 2025

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2025-05-28
Title
Smash Balloon Instagram Feed < 6.9.1 - Contributor+ Stored XSS via `data-plugin` Attribute
Fixed in
Fixed in 6.9.1
CVSS
5.9 (medium)
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.9.2
CVSS
4.7 (medium)
Published
2019-02-04
Title
Instagram Feed < 1.12 - Unspecified Issues
Fixed in
Fixed in 1.12
CVSS
n/a
Published
2018-01-18
Title
Instagram Feed < 1.6 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.6
CVSS
n/a
Published
2016-11-19
Title
Instagram Feed < 1.4.7 - Authenticated Cross-Site Scripting (XSS) & CSRF
Fixed in
Fixed in 1.4.7
CVSS
n/a