Cross-Site Scripting Flaw in WordPress Twitter Plugin by WordPress
CVE-2017-18505

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Twitter Button
Vendor
CVE Published:
12 August 2019

What is CVE-2017-18505?

The WordPress Twitter Plugin, prior to version 2.55, contains a Cross-Site Scripting (XSS) vulnerability that could allow an attacker to inject malicious scripts into the affected website. This security flaw can be exploited when user-supplied input is not properly sanitized, enabling unauthorized code execution in the context of the user’s browser. It is crucial for website administrators using the plugin to update to the latest version to protect against potential exploitation.

References

https://wordpress.org/plugins/twitter-plugin/#developers
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.