WP Manifestindependent plugin directory
manifest / social / wp-instafeed

WP Instagram Feed WP RegistryLow-severity findings · 1 findingOpen the reportA-

WordPress plugin to display Instagram photos of any user. Works without Access Token!

by Pixel Studio · github.com/hrsetyono/wp-instafeed · website

★ 1stars
6composer installs
1.1.1latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hrsetyono/wp-instafeed/archive/refs/heads/master.zip

On Packagist as pixelstudio/wp-instafeed:

composer require pixelstudio/wp-instafeed
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/hrsetyono/wp-instafeed ↗
Instagram Feed for WordPress Display instagram photos of any user. Works without Access Token! Note: Show by hashtag is not supported yet. This plugin is based on this PHP Library. Requirement - PHP version 7.x - WordPress version 4.9.x Shortcode SLIDER: STANDARD GALLERY: - username (string) - items-per-slide (string / optional) - Amount of photos per slide. Default value is 4/3/2 which mean 4 items on desktop, 3 items on medium screen ( thumbnailSrc - 640x640 size, if you need lower resolution, get it from thumbnails array. - medias = displaySrc - Original size.

Releases

3 releases.

Tag
Published
1.1.1 latest
Feb 4, 2020 6 years ago
1.1.0
Feb 3, 2020 6 years ago
1.0.0
Feb 3, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

WP Instagram Feed 1.1.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.1.1
Findings
1
Worst severity
low
Content hash
7b71c1e7998d296cd834dcad…

Findings

  • low Instafeed gallery anchors use unescaped remote URLs

    missing_escaping

    output_gallery concatenates $photo->displaySrc into href without esc_url. Username comes from shortcode attributes (content editors).

    public/shortcode.php:78-104

    Recommendation

    Escape URLs with esc_url and attributes with esc_attr.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →