What’s Vulnerable › Vulnerabilities

CVE-2021-24334: Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-01 · updated 2026-06-17
• Weakness: CWE-79

Description

The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.

Affected products

• connekthq Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy: before 4.4.0.1 — fixed in 4.4.0.1

How to fix

Upgrade to a fixed version: connekthq Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy 4.4.0.1. Check the vendor advisory for mitigations.

References

• https://m0ze.ru/vulnerability/%5B2021-04-22%5D-%5BWordPress%5D-%5BCWE-79%5D-Instant-Images-WordPress-Plugin-v4.4.0.txt
• https://wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4f
• https://m0ze.ru/vulnerability/%5B2021-04-22%5D-%5BWordPress%5D-%5BCWE-79%5D-Instant-Images-WordPress-Plugin-v4.4.0.txt
• https://wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4f

Get alerted when CVE-2021-24334 or the next vulnerability affects your stack