Medium severity5.4NVD Advisory· Published Jun 1, 2021· Updated Jun 17, 2026

CVE-2021-24334

Description

The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Connekthq/Instant Images One Click Unsplash Uploads
cpe:2.3:a:connekthq:instant_images_-_one_click_unsplash_uploads:*:*:*:*:*:wordpress:*:*
Range: <4.4.0.1
WordPress/Instant Images – One Click Unsplash Uploadsdescription
WordPress/Instant Imagesllm-fuzzy
Range: <4.4.0.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4fnvdExploitThird Party Advisory
m0ze.ru/vulnerability/%5B2021-04-22%5D-%5BWordPress%5D-%5BCWE-79%5D-Instant-Images-WordPress-Plugin-v4.4.0.txtnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000