WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure

Widgets for Social Photo Feed WordPress plugin = 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely. id: CVE-2025-14726 info: name: WordPress Widgets for Social Photo...

CVE-2026-39787

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

EUVD-2026-93032

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

CVE-2026-39787 WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

CVE-2026-39787 WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

CVE-2026-39787

The 10Web Social Photo Feed WordPress plugin, versions

PT-2026-106454

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 10Web Social Photo Feed versions = 1.4.35...

WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...

CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15452

The CVE covers the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. Affected software: WordPress plugin versions up to 6.11.3. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query String caused by insufficient input sanitization and output escaping. Impact:...

PT-2026-68088

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.4 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary we...

CVE-2026-15452: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12002

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

CVE-2026-12002: Cross-Site Request Forgery (CSRF)

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

CVE-2025-14726

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindexfeedhookinstagram/troubleshooting' and '/trustindexfeedhookinstagram/submit-data' REST API endpoints in all versions up...

CVE-2025-14726

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindexfeedhookinstagram/troubleshooting' and '/trustindexfeedhookinstagram/submit-data' REST API endpoints in all versions up...

CVE-2025-14726 Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindexfeedhookinstagram/troubleshooting' and '/trustindexfeedhookinstagram/submit-data' REST API endpoints in all versions up...

PT-2026-36564

Name of the Vulnerable Software and Affected Versions Widgets for Social Photo Feed versions prior to 1.9 Description Missing capability checks on the '/trustindex feed hook instagram/troubleshooting' and '/trustindex feed hook instagram/submit-data' REST API endpoints allow unauthenticated...

CVE-2025-14726: Exposure of Sensitive Information to an Unauthorized Actor

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindexfeedhookinstagram/troubleshooting' and '/trustindexfeedhookinstagram/submit-data' REST API endpoints in all versions up...