WordPress Plugin Vulnerabilities

10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

Description

The plugin was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users

Proof of Concept

Affects Plugins

Plugin icon
wd-instagram-feed
Fixed in 1.4.29

References

CVE
CVE-2021-25047

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Verified
Yes
WPVDB ID
d33241cc-17b6-491a-b836-dd9368652316

Timeline

Publicly Published
2021-12-07 (about 4 years ago)
Added
2021-12-07 (about 4 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2024-09-16
Title
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.6.12 - Reflected Cross-Site Scripting
Published
2021-06-21
Title
Simple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSS
Published
2025-07-14
Title
Companion Auto Update < 3.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
Published
2025-03-07
Title
Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-08-29
Title
Social Media & Share Icons < 2.8.4 - Reflected XSS