Instagram Feed Vulnerabilities

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVSS:

4.7

Affected:

up to 6.11.3

Fixed in:

6.11.4

Disclosed:

Aug 4, 2026

CVE-2026-15452 on NVD →

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers t...

CVSS:

4.7

Affected:

up to 6.11.1

Fixed in:

6.11.2

Disclosed:

Jul 8, 2026

CVE-2026-12002 on NVD →

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 (Free) and 6.8.0 (Pro) due to insufficient input sanitization and output escaping. This makes it possible for authe...

CVSS:

5.4

Affected:

up to 6.9.0

Fixed in:

6.9.1

Disclosed:

May 28, 2025

CVE-2025-4583 on NVD →

Several Smash Balloon Plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via URLs in various versions due to insufficient input sanitization and output escaping with the use of add_query_arg. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 2.9.1

Fixed in:

2.9.2

Disclosed:

Jul 20, 2021

Several Smash Balloon Plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via URLs in various versions due to insufficient input sanitization and output escaping with the use of add_query_arg. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

Affected:

up to 2.9.2

Fixed in:

2.9.2

Disclosed:

Jul 20, 2021

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.3. This is due to missing or incorrect nonce validation on the sbi_clear_backups() function. This makes it possible for unauthenticated attackers to clear the plugins back-ups via...

CVSS:

8.8

Affected:

up to 1.12

Fixed in:

1.12

Disclosed:

Mar 5, 2019

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.3. This is due to missing or incorrect nonce validation on the sbi_clear_backups() function. This makes it possible for unauthenticated attackers to clear the plugins back-ups via...

Affected:

up to 1.12

Fixed in:

1.12

Disclosed:

Mar 5, 2019

Cross-Site Scripting (XSS) vulnerability found Dumpcore in WordPress Instagram Feed plugin (versions <=1.5.1).

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Feb 7, 2018

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘access_token’ parameter in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

6.1

Affected:

up to 1.5.1

Fixed in:

1.6

Disclosed:

Jan 18, 2018

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘access_token’ parameter in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Jan 18, 2018

Because of this vulnerability, attackers can perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. Update the plugin.

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Nov 21, 2016

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in the settings page in versions up to, and including, 1.4.6.2 due to insufficient input sanitization and output escaping and missing nonce validation. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 1.4.6.2

Fixed in:

1.4.7

Disclosed:

Nov 19, 2016

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in the settings page in versions up to, and including, 1.4.6.2 due to insufficient input sanitization and output escaping and missing nonce validation. This makes it possible for authenti...

Affected:

up to 1.4.7

Fixed in:

1.4.7

Disclosed:

Nov 19, 2016

The plugins do not properly sanitise the URL generated to dismiss the New Users notifications, leading to a reflected Cross-Site Scripting issue

Affected:

up to 2.9.2

Fixed in:

2.9.2

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Unspecified Issues security vulnerability.

Affected:

up to 1.12

Fixed in:

1.12

The Smash Balloon Social Photo Feed WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.6

Fixed in:

1.6

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) &amp; CSRF security vulnerability.

Affected:

up to 1.4.7

Fixed in:

1.4.7

Affected:

up to 6.9.1

Fixed in:

6.9.1

CVE-2025-4583 on NVD →