Twitter Feeds
Monthly
The Twitter Feeds plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'tweet_title' parameter of the TwitterFeeds shortcode due to insufficient input sanitization and output escaping. All versions up to and including 1.0.0 are affected, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that persists in pages and executes for all users who view the compromised content. With a CVSS score of 6.4 (Medium) and CWE-79 classification, this vulnerability poses a meaningful risk to WordPress sites using this plugin, particularly those with permissive user role assignments.
The Twitter Feeds plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'tweet_title' parameter of the TwitterFeeds shortcode due to insufficient input sanitization and output escaping. All versions up to and including 1.0.0 are affected, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that persists in pages and executes for all users who view the compromised content. With a CVSS score of 6.4 (Medium) and CWE-79 classification, this vulnerability poses a meaningful risk to WordPress sites using this plugin, particularly those with permissive user role assignments.