WordPress Plugin Vulnerabilities

R3W Instafeed <= 1.0 - Reflected XSS

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Affects Plugins

Plugin icon
r3w-instafeed
No known fix

References

CVE
CVE-2024-13678

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Hassan Khan Yusufzai - Splint3r7
Submitter
Hassan Khan Yusufzai - Splint3r7
Submitter website
https://hassankhanyusufzai.com
Submitter twitter
Splint3r7
Verified
Yes
WPVDB ID
ba759796-a152-4f13-a474-f0368b4bc1f6

Timeline

Publicly Published
2025-02-04 (about 10 months ago)
Added
2025-02-04 (about 10 months ago)
Last Updated
2025-02-04 (about 10 months ago)

Other

Published
Title
Published
2025-09-05
Title
Widgetize Pages Light <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-01-10
Title
Easy Testimonials < 3.9.3 - Contributor+ Stored XSS
Published
2014-08-01
Title
Spider Calendar 1.1.0 - "many_sp_calendar" Cross-Site Scripting
Published
2025-01-16
Title
Simple Vertical Timeline <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-05-10
Title
Gutenberg Blocks by Kadence Blocks – Page Builder Features < 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer