CVE-2021-24413 – Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2021-24413

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode El plugin Easy Twitter Feed de WordPress versiones anteriores a 1.2, no sanea o comprueba los parámetros de su shortcode, permitiendo a usuarios con un rol tan bajo como el de colaborador establecer en ellos una carga útil de tipo Cross-Site Scripting que será desencadenada en la/s página/s con el shortcode malicioso insertado The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode. • https://wpscan.com/vulnerability/ce6d17c3-6741-4c80-ab13-e1824960ae24 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •