WordPress CVEs

Description

Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.

Affected WordPress components

• twitget Plugin · twitget
  Confirmed match Homeless
  Versions not specified; Up to and including 3.3.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• twitget_project twitget — Up to and including 3.3.1

References

• packetstormsecurity.com http://packetstormsecurity.com/files/126134 Exploit
• seclists.org http://seclists.org/fulldisclosure/2014/Apr/172 Exploit
• wordpress.org http://wordpress.org/plugins/twitget/changelog Vendor Advisory
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/92392
• security.dxw.com https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1 Exploit
• nvd.nist.gov Official NVD record