¿Es seguro Instagram Feed?

Qué hace este plugin

• Slug: instagram-feed
• 1000000+ instalaciones activas

Instagraminstagram feedinstagram galleryinstagram photosInstagram widget

Estado de mantenimiento

• Última versión conocida: 6.11.3
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

2 CVEs conocidos registrados para Instagram Feed.

CVE-2026-12002

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 2.9.2

Several Smash Balloon Plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via URLs in various versions due to insufficient input sanitization and output escaping with the use of add_query_arg. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.12

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.3. This is due to missing or incorrect nonce validation on the sbi_clear_backups() function. This makes it possible for unauthenticated attackers to clear the plugins back-ups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.6

Cross-Site Scripting (XSS) vulnerability found Dumpcore in WordPress Instagram Feed plugin (versions <=1.5.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.6

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘access_token’ parameter in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.4.7

Because of this vulnerability, attackers can perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.4.7

The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in the settings page in versions up to, and including, 1.4.6.2 due to insufficient input sanitization and output escaping and missing nonce validation. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-4583

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 (Free) and 6.8.0 (Pro) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 4 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 2.9.2	—	Desconocido	< 2.9.2	2.9.2	—	✓ corregido en la última versión
—	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.12	—	Desconocido	< 1.12	1.12	—	✓ corregido en la última versión
—	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.6	—	Desconocido	< 1.6	1.6	—	✓ corregido en la última versión
—	Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.4.7	—	Desconocido	< 1.4.7	1.4.7	—	✓ corregido en la última versión

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 2.9.2

The plugins do not properly sanitise the URL generated to dismiss the New Users notifications, leading to a reflected Cross-Site Scripting issue

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.12

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Unspecified Issues security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.6

The Smash Balloon Social Photo Feed WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.4.7

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) & CSRF security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Instagram Feed actualizado — 6.11.3 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Social Feed Gallery — 80000+ instalaciones activas — 90/100 (302) — PHP máx. 8.4
• Metricool – Social media and site statistics — 80000+ instalaciones activas — 78/100 (7) — PHP máx. 8.4
• Spotlight Social Feeds – Block, Shortcode, and Widget — 60000+ instalaciones activas — 94/100 (169) — PHP máx. 8.4
• WPZOOM Social Feed Widget & Block — 60000+ instalaciones activas — 86/100 (48)
• All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements — 40000+ instalaciones activas — 98/100 (541) — PHP máx. 8.4