InstaWP vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 202410
4. 20255
5. 20265

Newest CVEs

• CVE-2026-116399

  WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

  InstaWP · InstaWP Connect

  High8.8
• CVE-2026-109400

  InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

  instawp · InstaWP Connect – 1-click WP Staging & Migration

  High7.5
• CVE-2026-73401

  WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

  InstaWP · InstaWP Connect

  Medium5.3
• CVE-2026-13457

  InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure

  instawp · InstaWP Connect – 1-click WP Staging & Migration

  High7.5
• CVE-2026-39504

  WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability

  InstaWP · InstaWP Connect

  Medium5.4
• CVE-2025-66068

  WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability

  InstaWP · InstaWP Connect

  Medium6.5
• CVE-2025-2636

  InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion

  instawp · InstaWP Connect – 1-click WP Staging & Migration

  High8.1
• CVE-2025-31387

  WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability

  InstaWP · InstaWP Connect

  High7.5
• CVE-2024-13913

  InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion

  instawp · InstaWP Connect – 1-click WP Staging & Migration

  High8.8
• CVE-2024-10936

  String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

  instawp · String locator

  High8.8