WordPress Plugin Vulnerabilities

Instagram Feed < 1.4.7 - Authenticated Cross-Site Scripting (XSS) & CSRF

Description

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) & CSRF security vulnerability.

Affects Plugins

Plugin icon
instagram-feed
Fixed in 1.4.7

References

URL
https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_instagram_feed_plugin_via_csrf.html
URL
https://seclists.org/fulldisclosure/2016/Nov/115
URL
https://plugins.trac.wordpress.org/changeset/1464504/instagram-feed

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
d9a57a3a-251b-46cc-8f42-0c64657aaaa3

Timeline

Publicly Published
2016-11-19 (about 9 years ago)
Added
2016-11-21 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)

Other

Published
Title
Published
2024-12-13
Title
My IDX Home Search < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-03-02
Title
pixfort Core < 3.2.26 - Reflected Cross-Site Scripting
Published
2024-11-04
Title
Bing Search API Integration <= 0.3.3 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
ed2k-link-selector <= 1.1.7 - XSS in ZeroClipboard
Published
2024-10-18
Title
Easy Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting