CVE-2026-73401 | Medium | 5.3 | 2026-08-13 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. |
CVE-2026-13457 | High | 7.5 | 2026-08-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6… |
CVE-2026-39504 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66068 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-2636 | High | 8.1 | 2025-04-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85… |
CVE-2025-31387 | High | 7.5 | 2025-03-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connec… |
CVE-2024-13913 | High | 8.8 | 2025-03-14 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1… |
CVE-2024-10936 | High | 8.8 | 2025-01-21 | The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted inpu… |
CVE-2023-6987 | Medium | 6.1 | 2024-08-24 | The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-37228 | Critical | 10.0 | 2024-06-24 | Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <… |
CVE-2024-4898 | Critical | 9.8 | 2024-06-12 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on th… |
CVE-2024-32701 | Medium | 4.3 | 2024-06-09 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.24. |
CVE-2024-22145 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. |
CVE-2024-2667 | Critical | 9.8 | 2024-05-02 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /… |
CVE-2024-25918 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a… |
CVE-2024-23507 | High | 8.5 | 2024-01-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affect… |
CVE-2024-23506 | High | 7.7 | 2024-01-27 | Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through… |
CVE-2023-3956 | Critical | 9.8 | 2023-07-27 | The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check… |
CVE-2022-2434 | High | 8.8 | 2022-09-06 | The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and incl… |