Medium severity6.1NVD Advisory· Published Apr 23, 2018· Updated Jun 17, 2026

CVE-2018-10301

Description

Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.

Affected products

WordPress/Instagram Feed Wdinferred2 versions
<1.3.1+ 1 more
- (no CPE)range: <1.3.1
- (no CPE)range: <1.3.1
Package: https://wordpress.org/plugins/instagram-feed-wd
Web Dorado/Wd Instagram Feed
cpe:2.3:a:web-dorado:wd_instagram_feed:*:*:*:*:premium:wordpress:*:*
Range: <1.3.1

Patches

Vulnerability mechanics

References

medium.com/%40squeal/wd-instagram-feed-1-3-0-xss-vulnerabilities-cve-2018-10300-and-cve-2018-10301-7173ffc4c271nvd
wpvulndb.com/vulnerabilities/9393nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000