XSS in simple-instagram.php

Hi,

there are some XSS issues which can lead the a attacker taking over an admin account. Take a look at simple-instagram.php:

$recv_access_token = $_GET['code'];

Admin Input is not escaped! The best approach would be to use “esc_attr” in the following lines:

<?php echo esc_attr($recv_access_token); ?>
...
<?php echo esc_attr($user_id[0]); ?>

In the following lines you can see also output data which is not escaped. The issue shown above is particularly dangerous because an attacker can easily send a manipulated link with ?code=[XSS] via email/messange/… to the admin. If he clicks, a account takeover is no problem.

PS: WordFence does not protect you from backend xss 😉

Would love to see this fixed like above (and if you like a mention!)

Bye,

Damian | https://www.damianschwyrz.de