Cosenary Instagram-PHP-API contains reflected XSS vulnerability

MEDIO 6.1CVE-2019-14470 · GHSA-gcv6-2v9c-rj48 · Published 04/09/2019 · updated 17/06/2026

In breve

CVE-2019-14470 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda cosenary/instagram, user pro (userproplugin).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 83.0%, superiore al 99.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
cosenary/instagram Packagist	`≤ 2.3`	No fix yet
user pro userproplugin	`≤ 4.9.32`	No fix yet

Description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), used in the UserPro plugin through 4.9.32 for WordPress, is vulnerable to cross-site scripting via the example/success.php error_description parameter.

Vulnerable code:

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

Proof-of-Concept:

https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

NVD description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.

References

nvd.nist.gov/vuln/detail/CVE-2019-14470 · ADVISORY
cosenary/Instagram-PHP-API · PACKAGE
cosenary/Instagram-PHP-API · WEB
wpvulndb.com/vulnerabilities/9815 · WEB
exploit-db.com/exploits/47304 · WEB
packetstormsecurity.com/files/154206/WordPress-UserPro-4.9.32-Cross-Site-Scripting.html · WEB
cosenary/Instagram-PHP-API · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2019-14470 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda cosenary/instagram, user pro (userproplugin).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 83.0%, superiore al 99.7% delle vulnerabilità.

Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package

Affected versions

Patched versions

cosenary/instagram

Packagist

≤ 2.3

No fix yet

user pro

userproplugin

≤ 4.9.32

No fix yet

Description

Vulnerable code:

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

Proof-of-Concept:

https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

NVD description

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.