WP Manifestindependent plugin directory
manifest / media / auto-flickr-importer

Auto Flickr Importer WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Automatically import photos from Flickr to your WordPress site.

by WordPress.com Special Projects · github.com/a8cteam51/auto-flickr-importer · website

★ 2stars
37release downloads
≈10active sites
1.0.2latest · 1 year ago

Install

Download auto-flickr-importer.zip From the 1.0.2 release on GitHub, Oct 16, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/a8cteam51/auto-flickr-importer/releases/download/1.0.2/auto-flickr-importer.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/a8cteam51/auto-flickr-importer ↗

Description

Imports Flickr photos, videos, albums and comments into your WordPress site.

The Flickr API has a rate limit of 3600 API request per hour or 1 per second. Rate limit handling is implemented in the plugin to avoid exceeding the rate limit.

REQUIREMENTS

You need to create an application on Flickr to get the API key and secret. You can create an application on Flickr by visiting the following URL: https://www.flickr.com/services/apps/create/apply/

Enter the credentials in the plugin settings page.

Instructions

  1. Create an application on Flickr.
  2. Enter the API key and secret in the plugin settings page.
  3. Enter the username of the Flickr user whose photos you want to import and the username of the WordPress user who will be the author of the imported photos.
  4. Click on the "Run Initial Import" button to start the initial import process. This will import the public photos, videos, albums and comments from Flickr to WordPress. The import can take a few hours depending on the number of photos, videos and comments.
  5. The plugin will check for new photos, videos, albums and comments every hour import them to WordPress.
  6. Every 12 hours the plugin will check for new comments on all the imported photos and videos and import them to WordPress.

Changelog

1.0.0 (FIRST RELEASE DATE)

  • First official release.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.2 latest
Oct 16, 2025 1 year ago
auto-flickr-importer.zip
20
1.0.1
Aug 19, 2025 1 year ago
auto-flickr-importer.zip
4
1.0.0
Aug 12, 2024 2 years ago
auto-flickr-importer.zip
13

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Auto Flickr Importer 1.0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.2
Findings
1
Worst severity
high
Content hash
51ed320edeb737f78e88ef59…

Findings

  • high Stored XSS via unsanitized, auto-approved Flickr comment import

    xss_stored

    wpcomsp_insert_comment_if_not_exists() copies Flickr API comment fields straight into wp_insert_comment(): comment_content is $comment['_content'], comment_author is $comment['authorname'], and comment_meta stores _flickr_author_nsid from $comment['author']. wp_insert_comment() does not run wp_filter_comment() or pre_comment_content kses (those run only on wp_new_comment()), and omitting comment_approved stores the row as approved (core default 1), so Akismet/moderation and comment kses are all skipped. Comment_Delta_Importer::run_import() does this for every imported photo on a 12-hour Action Scheduler loop; any Flickr user who can comment on those public photos is an unauthenticated writer from WordPress's point of view. Flickr documents HTML in comments (b/i/u/del/blockquote, and the html.gne allowlist also includes <a href> and <img src>). Core comment_text() echoes comment_content as HTML with no wp_kses on output, and get_comment_author_link() interpolates author and URL into an <a href='...'> without escaping. Observable consequence: HTML from a Flickr comment is served on the WordPress post to every visitor; a payload that survives Flickr's store (script tags, event-handler attributes, javascript: URLs, or a sanitizer bypass) executes in those browsers, and even 'allowed' <img src> becomes a live tracking/skimmer pixel on the WP site. The get_comment_author_url filter in includes/hooks.php further concatenates the stored NSID onto https://flickr.com/people/ without esc_url().

    includes/helpers.php:258-271

    Recommendation

    Do not insert Flickr comments through raw wp_insert_comment(). Pass the row through wp_filter_comment() / wp_kses() (comment-allowed tags only), sanitize_text_field() the author name, sanitize the NSID (e.g. preg_replace to [0-9]+@N[0-9]+), and set comment_approved based on discussion_settings rather than the insert default. Prefer wp_new_comment() so pre_comment_content and Akismet run. In wpcomsp_auto_flickr_importer_flickr_comment_author_url(), build the URL with esc_url(). Hold imported comments for moderation if the site does not want arbitrary Flickr HTML going live.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →