1 results (0.003 seconds)

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1

Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts. The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •