plugin
33 known security issues reported for the Instagram Slider Widget WordPress plugin. Most recent disclosed Apr 16, 2026.
Running Instagram Slider Widget on your site? Check whether your installed version is affected.
Scan your site freeThe Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acc...
[en] The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to injec...
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to injec...
[en] Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2.
The Social Slider Feed plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hashtag parameter in versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inj...
Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.6). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.7).
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hashtag parameter in versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inj...
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via API key in versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary...
Authenticated Stored Cross-Site Scripting (XSS) vulnerability via API Key discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.5). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.6).
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via API key in versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary...
The Social Slider Feed plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.4. This is due to missing capability checks and nonce validation on the 'showPageContent' function. This makes it possible for unauthenticated attackers to trigger feed deletion.
The Social Slider Feed plugin for WordPress is vulnerable to authenticated arbitrary API key update via the YouTube API key in versions up to, and including 2.0.4. This makes it possible for a subscriber-level attacker to change the API key. Proper sanitization is also missing allowing the attacker to inject malicious...
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber level permissions to inject arbitrary web scripts in pages that...
The Social Slider Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...
The Social Slider Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber level permissions to inject arbitrary web scripts in pages that...
The Social Slider Feed plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.4. This is due to missing capability checks and nonce validation on the 'showPageContent' function. This makes it possible for unauthenticated attackers to trigger feed deletion.
The Social Slider Feed plugin for WordPress is vulnerable to authenticated arbitrary API key update via the YouTube API key in versions up to, and including 2.0.4. This makes it possible for a subscriber-level attacker to change the API key. Proper sanitization is also missing allowing the attacker to inject malicious...
The Social Slider Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...
Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.4). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).
Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.4). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).
Authenticated Arbitrary Feed Deletion vulnerability discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.4). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).
Authenticated Arbitrary API Key Update vulnerability leading to Stored Cross-Site Scripting (XSS) discovered by WPScan in WordPress Social Slider Feed plugin (versions <= 2.0.4). Update the WordPress Social Slider Feed plugin to the latest available version (at least 2.0.5).
[en] The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
The plugin does not sanitise as well as escape user input in feeds, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting
The plugin does not have authorisation and CSRF check in place when saving the YouTube API Key, and does not sanitise as well as escape it. As a result, users with a role as low as subscriber could change it, including setting it with Stored Cross-Site Scripting payloads in it
The plugin does not have authorisation and CSRF check in place when deleting feeds, allowing ay authenticated users, such as subscriber to delete arbitrary feeds
The plugin does not have authorisation and CSRF check in place when adding and editing a Feed, and does not sanitise as well as escape user input. As a result, users with a role as low as subscriber could add arbitrary feeds, with Stored Cross-Site Scripting payloads in them.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free