WPZOOM Social Feed Widget & Block Security & Risk Analysis

wordpress.org/plugins/instagram-widget-by-wpzoom

Instagram feed plugin for WordPress: Display your Instagram photos, videos & reels. Easy setup with Gutenberg block, widget, shortcode & Elementor

60K active installs v2.3.4 PHP 7.4+ WP 6.0+ Updated Feb 24, 2026
instagraminstagram-feedinstagram-galleryinstagram-photosinstagram-widget
99
A · Safe
CVEs total1
Unpatched0
Last CVEApr 12, 2024
Safety Verdict

Is WPZOOM Social Feed Widget & Block Safe to Use in 2026?

Generally Safe

Score 99/100

WPZOOM Social Feed Widget & Block has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Apr 12, 2024Updated 1mo ago
Risk Assessment

The "instagram-widget-by-wpzoom" v2.3.4 plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization and output escaping, there are notable concerns. The presence of two AJAX handlers lacking authentication checks presents a significant attack surface that could be exploited. The taint analysis revealing one high-severity flow with unsanitized paths, although not explicitly detailed as a vulnerability, warrants caution. The vulnerability history, while currently clear of unpatched CVEs, includes a past medium-severity vulnerability primarily related to missing authorization, which aligns with the static analysis findings of unprotected AJAX endpoints. This suggests a recurring pattern of authorization weaknesses that need ongoing vigilance.

Key Concerns

  • Unprotected AJAX handlers found
  • High severity taint flow with unsanitized path
  • Past medium vulnerability (Missing Authorization)
Vulnerabilities
1

WPZOOM Social Feed Widget & Block Security Vulnerabilities

CVEs by Year

1 CVE in 2024
2024
Patched Has unpatched

Severity Breakdown

Medium
1

1 total CVE

CVE-2024-3662medium · 4.3Missing Authorization

WPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion

Apr 12, 2024 Patched in 2.1.14 (1d)
Code Analysis
Analyzed Mar 16, 2026

WPZOOM Social Feed Widget & Block Code Analysis

Dangerous Functions
0
Raw SQL Queries
1
6 prepared
Unescaped Output
92
653 escaped
Nonce Checks
21
Capability Checks
24
File Operations
1
External Requests
20
Bundled Libraries
0

SQL Query Safety

86% prepared7 total queries

Output Escaping

88% escaped745 total outputs
Data Flows
2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths
<class-wpzoom-instagram-widget-display> (includes\class-wpzoom-instagram-widget-display.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
2 unprotected

WPZOOM Social Feed Widget & Block Attack Surface

Entry Points17
Unprotected2

AJAX Handlers 16

authwp_ajax_wpzoom_instagram_clear_dataincludes\class-wpzoom-instagram-general-settings.php:42
authwp_ajax_wpzoom_instagram_fetch_insightsincludes\class-wpzoom-instagram-insights.php:61
authwp_ajax_wpzoom_instagram_load_more_postsincludes\class-wpzoom-instagram-insights.php:62
authwp_ajax_dismiss_wpz_insta_basic_api_noticeincludes\class-wpzoom-instagram-widget-api.php:1467
authwp_ajax_wpzoom_instagram_load_moreincludes\class-wpzoom-instagram-widget-display.php:54
noprivwp_ajax_wpzoom_instagram_load_moreincludes\class-wpzoom-instagram-widget-display.php:55
authwp_ajax_wpzoom_instagram_preview_load_moreincludes\class-wpzoom-instagram-widget-display.php:58
authwp_ajax_wpz-insta_connect-userincludes\class-wpzoom-instagram-widget-settings.php:344
authwp_ajax_wpz-insta_connect_business-userincludes\class-wpzoom-instagram-widget-settings.php:346
authwp_ajax_wpz-insta_connect_business-accountincludes\class-wpzoom-instagram-widget-settings.php:347
authwp_ajax_inline-saveincludes\class-wpzoom-instagram-widget-settings.php:349
authwp_ajax_wpz-insta_dismiss-cron-noticeincludes\class-wpzoom-instagram-widget-settings.php:350
authwp_ajax_wpz-insta_get-productsincludes\class-wpzoom-instagram-widget-settings.php:354
authwp_ajax_wpz-insta_save-product-linkincludes\class-wpzoom-instagram-widget-settings.php:355
authwp_ajax_wpz-insta_get-product-linkincludes\class-wpzoom-instagram-widget-settings.php:356
authwp_ajax_wpz-insta_get-album-imagesincludes\class-wpzoom-instagram-widget-settings.php:357

Shortcodes 1

[instagram] includes\class-wpzoom-instagram-widget-display.php:51
WordPress Hooks 83
actionelementor/initelementor\class-wpzoom-instagram-elementor.php:49
actionelementor/elements/categories_registeredelementor\class-wpzoom-instagram-elementor.php:66
actionelementor/widgets/registerelementor\class-wpzoom-instagram-elementor.php:67
actionelementor/editor/before_enqueue_scriptselementor\class-wpzoom-instagram-elementor.php:68
actionenqueue_block_assetsincludes\class-wpzoom-instagram-assets.php:65
actionenqueue_block_assetsincludes\class-wpzoom-instagram-assets.php:66
actionenqueue_block_editor_assetsincludes\class-wpzoom-instagram-assets.php:68
actionwp_enqueue_scriptsincludes\class-wpzoom-instagram-assets.php:70
actionwp_enqueue_scriptsincludes\class-wpzoom-instagram-assets.php:71
actionwp_enqueue_scriptsincludes\class-wpzoom-instagram-assets.php:72
actionsiteorigin_panel_enqueue_admin_scriptsincludes\class-wpzoom-instagram-assets.php:77
actionsiteorigin_panel_enqueue_admin_scriptsincludes\class-wpzoom-instagram-assets.php:78
actionsiteorigin_panel_enqueue_admin_scriptsincludes\class-wpzoom-instagram-assets.php:79
actioninitincludes\class-wpzoom-instagram-block.php:44
filterblock_categories_allincludes\class-wpzoom-instagram-block.php:45
actioninitincludes\class-wpzoom-instagram-email-notification.php:55
actionwpzoom_instagram_api_key_statusincludes\class-wpzoom-instagram-email-notification.php:58
actionadmin_initincludes\class-wpzoom-instagram-general-settings.php:40
actioninitincludes\class-wpzoom-instagram-image-uploader.php:24
filterintermediate_image_sizes_advancedincludes\class-wpzoom-instagram-image-uploader.php:200
filterintermediate_image_sizes_advancedincludes\class-wpzoom-instagram-image-uploader.php:292
filterwp_insert_attachment_dataincludes\class-wpzoom-instagram-image-uploader.php:293
actionadmin_menuincludes\class-wpzoom-instagram-insights.php:58
actionadmin_enqueue_scriptsincludes\class-wpzoom-instagram-insights.php:59
actionadmin_headincludes\class-wpzoom-instagram-insights.php:60
filterwpzoom_notice_center_noticesincludes\class-wpzoom-instagram-review-notice.php:39
actioninitincludes\class-wpzoom-instagram-widget-after-setup.php:36
actioninitincludes\class-wpzoom-instagram-widget-after-setup.php:37
actioninitincludes\class-wpzoom-instagram-widget-api.php:74
actionwpzoom_instagram_widget_cron_hookincludes\class-wpzoom-instagram-widget-api.php:75
filtercron_schedulesincludes\class-wpzoom-instagram-widget-api.php:76
actionadmin_noticesincludes\class-wpzoom-instagram-widget-api.php:1412
actioninitincludes\class-wpzoom-instagram-widget-settings.php:149
filterviews_edit-wpz-insta_feedincludes\class-wpzoom-instagram-widget-settings.php:151
filterviews_edit-wpz-insta_userincludes\class-wpzoom-instagram-widget-settings.php:152
actionadmin_menuincludes\class-wpzoom-instagram-widget-settings.php:154
actionadmin_initincludes\class-wpzoom-instagram-widget-settings.php:155
filterplugin_action_linksincludes\class-wpzoom-instagram-widget-settings.php:157
actionadmin_enqueue_scriptsincludes\class-wpzoom-instagram-widget-settings.php:159
actionadmin_enqueue_scriptsincludes\class-wpzoom-instagram-widget-settings.php:317
actionadmin_noticesincludes\class-wpzoom-instagram-widget-settings.php:318
actionall_admin_noticesincludes\class-wpzoom-instagram-widget-settings.php:319
filteradmin_body_classincludes\class-wpzoom-instagram-widget-settings.php:320
filterparent_fileincludes\class-wpzoom-instagram-widget-settings.php:321
filtersubmenu_fileincludes\class-wpzoom-instagram-widget-settings.php:322
filtermanage_wpz-insta_feed_posts_columnsincludes\class-wpzoom-instagram-widget-settings.php:323
filtermanage_wpz-insta_user_posts_columnsincludes\class-wpzoom-instagram-widget-settings.php:324
filtermanage_edit-wpz-insta_feed_sortable_columnsincludes\class-wpzoom-instagram-widget-settings.php:325
filtermanage_edit-wpz-insta_user_sortable_columnsincludes\class-wpzoom-instagram-widget-settings.php:326
filterscreen_options_show_screenincludes\class-wpzoom-instagram-widget-settings.php:327
filterhidden_meta_boxesincludes\class-wpzoom-instagram-widget-settings.php:328
filterhidden_columnsincludes\class-wpzoom-instagram-widget-settings.php:329
filterwp_insert_post_dataincludes\class-wpzoom-instagram-widget-settings.php:330
filterview_mode_post_typesincludes\class-wpzoom-instagram-widget-settings.php:331
filterdisplay_post_statesincludes\class-wpzoom-instagram-widget-settings.php:332
filterget_edit_post_linkincludes\class-wpzoom-instagram-widget-settings.php:333
filterredirect_post_locationincludes\class-wpzoom-instagram-widget-settings.php:334
filteradmin_footer_textincludes\class-wpzoom-instagram-widget-settings.php:335
filterupdate_footerincludes\class-wpzoom-instagram-widget-settings.php:336
actionmanage_wpz-insta_feed_posts_custom_columnincludes\class-wpzoom-instagram-widget-settings.php:337
actionmanage_wpz-insta_user_posts_custom_columnincludes\class-wpzoom-instagram-widget-settings.php:338
actionadd_inline_dataincludes\class-wpzoom-instagram-widget-settings.php:339
actionpre_get_postsincludes\class-wpzoom-instagram-widget-settings.php:340
actionedit_form_topincludes\class-wpzoom-instagram-widget-settings.php:341
actionedit_form_after_titleincludes\class-wpzoom-instagram-widget-settings.php:342
actionin_admin_footerincludes\class-wpzoom-instagram-widget-settings.php:343
actionsave_post_wpz-insta_feedincludes\class-wpzoom-instagram-widget-settings.php:360
actionsave_post_wpz-insta_userincludes\class-wpzoom-instagram-widget-settings.php:361
actionwp_after_insert_postincludes\class-wpzoom-instagram-widget-settings.php:362
actionquick_edit_custom_boxincludes\class-wpzoom-instagram-widget-settings.php:363
actionpost_action_wpz-insta_duplicate-feedincludes\class-wpzoom-instagram-widget-settings.php:364
actionpost_action_wpz-insta_update-postsincludes\class-wpzoom-instagram-widget-settings.php:365
actionpost_action_wpz-insta_update-storiesincludes\class-wpzoom-instagram-widget-settings.php:366
actionpost_edit_form_tagincludes\class-wpzoom-instagram-widget-settings.php:367
actionin_admin_headerincludes\class-wpzoom-instagram-widget-settings.php:369
actionadmin_initincludes\class-wpzoom-instagram-widget-settings.php:401
actionwp_enqueue_scriptsincludes\class-wpzoom-instagram-widget-settings.php:411
actionshutdownincludes\class-wpzoom-instagram-widget-settings.php:415
filterfinal_outputincludes\class-wpzoom-instagram-widget-settings.php:426
actionwidgets_initinstagram-widget-by-wpzoom.php:64
actioninitinstagram-widget-by-wpzoom.php:175
actioninitinstagram-widget-by-wpzoom.php:216
actionplugins_loadedinstagram-widget-by-wpzoom.php:227

Scheduled Events 2

wpzoom_instagram_api_key_status
wpzoom_instagram_widget_cron_hook
Maintenance & Trust

WPZOOM Social Feed Widget & Block Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 24, 2026
PHP min version7.4
Downloads2.6M

Community Trust

Rating86/100
Number of ratings48
Active installs60K
Developer Profile

WPZOOM Social Feed Widget & Block Developer Profile

WPZOOM

24 plugins · 337K total installs

76
trust score
Avg Security Score
96/100
Avg Patch Time
102 days
View full developer profile
Detection Fingerprints

How We Detect WPZOOM Social Feed Widget & Block

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/instagram-widget-by-wpzoom/assets/css/backend.css/wp-content/plugins/instagram-widget-by-wpzoom/assets/css/frontend.css/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed.min.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.min.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/frontend.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/frontend.min.js
Script Paths
/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed.min.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.min.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/frontend.js/wp-content/plugins/instagram-widget-by-wpzoom/assets/js/frontend.min.js
Version Parameters
instagram-widget-by-wpzoom/assets/css/backend.css?ver=instagram-widget-by-wpzoom/assets/css/frontend.css?ver=instagram-widget-by-wpzoom/assets/js/instagram-feed.js?ver=instagram-widget-by-wpzoom/assets/js/instagram-feed.min.js?ver=instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.js?ver=instagram-widget-by-wpzoom/assets/js/instagram-feed-backend.min.js?ver=instagram-widget-by-wpzoom/assets/js/frontend.js?ver=instagram-widget-by-wpzoom/assets/js/frontend.min.js?ver=

HTML / DOM Fingerprints

CSS Classes
wpzoom-instagram-widgetwpzoom-instagram-feed
HTML Comments
<!-- WPZOOM Instagram Feed Widget --><!-- WPZOOM Instagram Widget -->
Data Attributes
data-widget-iddata-user-iddata-access-token
JS Globals
wpzoom_instagram_frontend_obj
Shortcode Output
[instagram-feed
FAQ

Frequently Asked Questions about WPZOOM Social Feed Widget & Block