Twittee Text Tweet <= 1.0.8 - Reflected XSS
CVE-2023-0602

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Twittee Text Tweet
Vendor
CVE Published:
31 July 2023

What is CVE-2023-0602?

The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.

Affected Version(s)

Twittee Text Tweet 0 <= 1.0.8

References

https://wpscan.com/vulnerability/c357f93d-4f21-4cd9-9378-...
exploitvdb-entrytechnical-description

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shreya Pohekar
WPScan
.