WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
instagram-feed
Published
2025-05-28
Title
Smash Balloon Instagram Feed < 6.9.1 - Contributor+ Stored XSS via `data-plugin` Attribute
Slug
instagram-for-wordpress
Published
2023-10-03
Title
Instagram for WordPress <= 2.1.6 - Contributor+ Stored XSS
Slug
instagram-slider-widget
Published
2021-03-14
Title
Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
instagram-slider-widget
Published
2022-08-01
Title
Social Slider Feed < 2.0.5 - Subscriber+ Arbitrary Feed Deletion
Slug
instagram-slider-widget
Published
2022-08-01
Title
Social Slider Feed < 2.0.5 - Subscriber+ Stored XSS via Feeds
Slug
instagram-slider-widget
Published
2022-08-01
Title
Social Slider Feed < 2.0.5 - Reflected Cross-Site Scripting
Slug
instagram-slider-widget
Published
2022-08-02
Title
Social Slider Feed < 2.0.6 - Admin+ Stored XSS via API Key
Slug
instagram-slider-widget
Published
2022-08-09
Title
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
Slug
instagram-slider-widget
Published
2022-08-01
Title
Social Slider Feed < 2.0.5 - Subscriber+ Arbitrary API Key Update to Stored XSS
Slug
instagram-slider-widget
Published
2024-08-09
Title
Social Slider Feed < 2.2.5 - Missing Authorization
Slug
instagram-slider-widget
Published
2024-09-27
Title
Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets
Slug
instagram-slider-widget
Published
2025-03-03
Title
Social Slider Feed < 2.2.9 - Admin+ Stored XSS
Slug
instagram-widget-by-wpzoom
Published
2024-04-12
Title
WPZOOM Social Feed Widget & Block < 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion
Slug
instagrate-to-wordpress
Published
2024-04-10
Title
Intagrate Lite < 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
instalinker
Published
2016-02-07
Title
InstaLinker <= 1.1.1 - Reflected Cross-Site Scripting (XSS)
Slug
instant-appointment
Published
2024-12-12
Title
Instant Appointment <= 1.2 - Unauthenticated SQL Injection
Slug
instant-appointment
Published
2025-01-16
Title
Instant Appointment <= 1.2 - Reflected Cross-Site Scripting
Slug
instant-appointment
Published
2025-03-20
Title
Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
Slug
instant-breaking-news
Published
2025-08-27
Title
Instant Breaking News < 1.0.1 - Cross-Site Request Forgery
Slug
instant-chat-wp
Published
2024-09-24
Title
Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion
Slug
instant-css
Published
2023-07-24
Title
Instant CSS < 1.1.5 - Subscriber+ Unauthorised AJAX Calls
Slug
instant-css
Published
2023-09-29
Title
Instant CSS < 1.2.2 - Theme/CSS/Minify/Preprocessor Data Update via CSRF
Slug
instant-images
Published
2021-05-17
Title
Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS
Slug
instant-images
Published
2023-03-02
Title
Instant Images < 5.2.0 - Author+ SSRF
Slug
instant-images
Published
2024-01-29
Title
Instant Images < 6.1.1 - Author+ Arbitrary Options Update