CVE-2017-16758: Ultimate Instagram Feed Project Ultimate Instagram Feed

Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "access_token" parameter.

Affected products

• Ultimate Instagram Feed Project Ultimate Instagram Feed: before 1.3 (fixed in 1.3)

Published 2017-11-09. Last modified 2026-06-17.