CVE-2014-2995 Twitget <= 3.3.2 - Stored Cross-Site Scripting
LowCVSS 3.5
EPSS 3.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twitget project twitget | <= 3.3.1 | No fix listed |
| wordpress twitget(WordPress) | < 3.3.3 | 3.3.3 |
References
- packetstormsecurity.com exploit
- 20140411 CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin) exploit mailing-list
- wordpress.org vendor-advisory
- twitget-wordpress-xss(92392) vdb-entry
- security.dxw.com exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org