Plugins · insta-gallery · data as of 2026-11-04
Is Social Feed Gallery safe? Known vulnerabilities and latest version
- Latest version
- 5.0.13
- Last updated
- 2026-10-21
- Active installs
- 80,000+
- Known issues on record
- 4
- Unpatched in latest
- 1
- Tested up to WP
- 7.1.4 · PHP 5.6+
Formerly known as "Instagram Feed", this is the best plugin for displaying Instagram feeds on WordPress. It also supports Instagram reels. — by quadlayers
What to do
- There is no fixed version yet. If you can live without Social Feed Gallery for now, deactivate it and delete it until the developer ships a fix.
- If you must keep it, limit who can log in (remove unused accounts, especially low-level ones) and put a web application firewall in front of the site.
- Watch for an update: get an email when this page changes.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan, or have us clean it: Emergency Cleanup, $499.
With WP-CLI: wp plugin get insta-gallery --field=version shows what you run; wp plugin update insta-gallery updates it.
Check your version
Known vulnerabilities
4 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 6.5 affects latest 5.0.13 CVE-2026-114705 · published 2026-10-24
Missing authorization check in Social Feed Gallery (5.0.13 and older)
- Affected
- 5.0.13 and older
- Fixed in
- no fix listed yet
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
medium 5.3 CVE-2025-10637 · published 2025-10-25
Information disclosure in Social Feed Gallery (4.9.2 and older)
- Affected
- 4.9.2 and older
- Fixed in
- 4.9.3 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Social Feed Gallery plugin for WordPress is vulnerable to Information Exposure in versions less than, or equal to, 4.9.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate Instagram profile and media data from any account the site owner connected to their site.
NVD CVE-2025-10637Wordfence advisoryCode change (fix)wordpress.orgPlugin source
medium 6.5 CVE-2024-39640 · published 2024-11-01
Missing authorization check in Social Feed Gallery (4.3.9 and older)
- Affected
- 4.3.9 and older
- Fixed in
- 4.4.0
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in QuadLayers WP Social Feed Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 4.3.9.
high 8.8 CVE-2019-15779 · published 2019-08-29
Cross-site request forgery (CSRF) in Social Feed Gallery (older than 2.4.8)
- Affected
- older than 2.4.8
- Fixed in
- 2.4.8
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- advisory text · score by NVD
Details from the advisory
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
Recent activity
- 2026-10-21 — latest release on wordpress.org (5.0.13).
- 2026-10-24 — Missing authorization check disclosed (CVE-2026-114705), no fix listed yet.
- 2025-10-25 — Information disclosure disclosed (CVE-2025-10637), fixed in 4.9.3.
- 2024-11-01 — Missing authorization check disclosed (CVE-2024-39640), fixed in 4.4.0.
Get an email when Social Feed Gallery has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Social Feed Gallery (insta-gallery) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by quadlayers (7 tracked)
Types found in this plugin: Missing authorization (2) · Sensitive data exposure (1) · Cross-site request forgery (CSRF) (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/insta-gallery (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/insta-gallery"><img src="https://laskyr.com/plugins/insta-gallery/badge.svg" alt="Social Feed Gallery vulnerability status"></a>