Stored Cross-Site Scripting in Twitter Follow Button Plugin for WordPress

CVE-2024-10116

Summary

The Twitter Follow Button plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'username' parameter. This vulnerability allows authenticated users with Contributor-level access and higher to inject malicious web scripts. The injected scripts execute when other users visit the affected pages, potentially leading to information theft and site compromise. Website administrators should prioritize updating to secure versions and review plugin configurations to mitigate this risk.

References