Plugin icon

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

instagram-feed

Vulnerabilities:

6

Last Updated:

July 22, 2026

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2026-07-08
Title
Smash Balloon Social Photo Feed < 6.11.2 - Unauthenticated oEmbed Access Token Overwrite via CSRF
Fixed in
Fixed in 6.11.2
CVSS
4.3 (medium)
Published
2025-05-28
Title
Smash Balloon Instagram Feed < 6.9.1 - Contributor+ Stored XSS via `data-plugin` Attribute
Fixed in
Fixed in 6.9.1
CVSS
5.9 (medium)
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.9.2
CVSS
4.7 (medium)
Published
2019-02-04
Title
Instagram Feed < 1.12 - Unspecified Issues
Fixed in
Fixed in 1.12
CVSS
n/a
Published
2018-01-18
Title
Instagram Feed < 1.6 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.6
CVSS
n/a
Published
2016-11-19
Title
Instagram Feed < 1.4.7 - Authenticated Cross-Site Scripting (XSS) & CSRF
Fixed in
Fixed in 1.4.7
CVSS
n/a