Login Request a demo
IN
Vendor
InstaWP
3 products with CVEs on record
26
CVEs
0
On KEV
2
New 30D
Products
IC
InstaWP Connect
InstaWP
9.8
15 CVEs0 on KEV1 new
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
9.8
8 CVEs0 on KEV1 new
SL
String locator
instawp
8.8
3 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116399
New
IC
InstaWP Connect
InstaWP
8.8–Oct 29WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-109400
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
7.5
0%
Oct 16InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
CVE-2026-73401
IC
InstaWP Connect
InstaWP
5.3
0%
Aug 13WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
CVE-2026-13457
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
7.5
1%
Aug 11InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
CVE-2026-39504
IC
InstaWP Connect
InstaWP
5.4
0%
Apr 8WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability
CVE-2025-66068
IC
InstaWP Connect
InstaWP
6.5
0%
Dec 18WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability
CVE-2025-2636
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
8.1
11%
Apr 11InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
CVE-2025-31387
IC
InstaWP Connect
InstaWP
7.5
1%
Mar 31WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability
CVE-2024-13913
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
8.8
3%
Mar 14InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
CVE-2024-10936
SL
String locator
instawp
8.8
1%
Jan 21String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
CVE-2023-6987
SL
String locator
instawp
6.1
0%
Aug 24String Locator <= 2.6.5 - Reflected Cross-Site Scripting
CVE-2024-6397
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
9.8
1%
Jul 11InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
CVE-2024-37228
IC
InstaWP Connect
InstaWP
9.8
1%
Jun 24WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability
CVE-2024-4898
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
9.8
4%
Jun 12InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
CVE-2024-32701
IC
InstaWP Connect
InstaWP
8.8
0%
Jun 9WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability
CVE-2024-22145
IC
InstaWP Connect
InstaWP
8.8
1%
May 17WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability
CVE-2024-2667
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
9.8
6%
May 2InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
CVE-2024-25918
IC
InstaWP Connect
InstaWP
8.8
1%
Apr 3WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability
CVE-2024-23507
IC
InstaWP Connect
InstaWP
8.8
1%
Jan 31WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability
CVE-2024-23506
IC
InstaWP Connect
InstaWP
6.5
1%
Jan 26WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability
CVE-2023-3956
IC
InstaWP Connect – 1-click WP Staging & Migration
instawp
9.8
1%
Jul 27InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
CVE-2022-2434
SL
String Locator
Instawp
8.8
2%
Sep 6The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0