Vytis

Hi @danielbowen,

Thank you for reaching out and sharing your concerns. We completely understand if the permission requests look excessive at first glance—privacy and security are top priorities for us as well.

Why those permissions are requested: The “Manage your business” and business_management permissions are, unfortunately, a technical requirement recently mandated by Meta (Facebook/Instagram) for their Graph API.

Here is exactly what we access and why:

• business_management: Required by Meta to retrieve the list of Pages and Instagram accounts in your Business Portfolio. We only use this to identify which account you want to display.
• instagram_basic: Allows the plugin to read your Instagram profile info (username, profile picture) and media (photos/videos) to build the slider.
• pages_show_list & pages_read_engagement: Used to identify the Facebook Page connected to your Instagram account and to read basic engagement stats.
• pages_read_user_content: A standard permission that allows the plugin to load the actual media content and captions from your Page’s feed.

Specifically:

• API Requirements: To simply see a list of Facebook Pages and their connected Instagram accounts via the /me/accounts endpoint, Meta now requires this higher-level permission. Without it, the plugin often cannot “see” your accounts at all.
• Read-Only Use: While the permission technically allows for “management,” our plugin only uses it to read your public post data to display the slider. We do not—and will never—modify your business settings, delete content, or grant third-party access.

Regarding recent reviews and performance: You mentioned seeing reports that the plugin may not be working properly for some users. We want to make sure your experience is seamless. Are you currently encountering any specific errors, such as images not loading or connection timeouts?

We recently released new versions which include enhanced security and improved compatibility with the latest WordPress and Meta API changes. If you are having any trouble, please let us know the details, and we’ll be happy to investigate and help you get it resolved immediately.

Hi @mywebe1,

The vulnerability already appears as patched in patchstack system as well.

Thank you for your patience and have a nice day.

Hi @rsb1234,

We’ve confirmed that the fix was incorrectly flagged as still vulnerable and this issue was fully resolved in version 8.2.6 as mentioned before. The vulnerability is patched, and you’re safe if you’re running the latest versions of the plugin.

For reference, here’s the updated report confirming the patch:
https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-3-0-sql-injection-vulnerability

Wordfence’s listing should also be updated shortly once they refresh their data.

Thanks again for bringing this to our attention once again.

Hi @irawibowo,

The issue is fixed with the latest version of the plugin. Thank you for reporting it!

Hi @irongenetics96,

Thank you once again for reporting the issues.
Today we made a patched release of the plugin where mentioned issues were addressed.