InstaWP

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

InstaWP records in CISA KEV

No InstaWP vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Instawp Connect 10 records MEDIUM String Locator 3 records MEDIUM

Records

3 records in String Locator · all components

TI-2022-02248 CVE-2022-2434 · GHSA-q8hw-79g9-xx95

String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization

MEDIUM 43

The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01617 Published 2022-09-06 No fix listed CWE-502

TI-2024-10137 CVE-2024-10936 · GHSA-mwfx-c8wp-957c

String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

MEDIUM 42

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01139 Published 2025-01-21 No fix listed CWE-502

TI-2023-06388 CVE-2023-6987 · GHSA-3p4c-mxjg-9xjw

String Locator <= 2.6.5 - Reflected Cross-Site Scripting

LOW 27

The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00308 Published 2024-08-24 No fix listed CWE-79

Open these records in search →

Critical	6
High	12
Medium	4
Low	0
No CVSS	0