Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/ | Exploit Third Party Advisory |
Configurations
History
27 Aug 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
17 May 2025, 02:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:smashballoon:custom_twitter_feeds:*:*:*:*:*:wordpress:*:* | |
| First Time |
Smashballoon
Smashballoon custom Twitter Feeds |
|
| CWE | CWE-77 | |
| References | () https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/ - Exploit, Third Party Advisory |
Information
Published : 2024-10-08 06:15
Updated : 2025-09-30 18:16
NVD link : CVE-2024-8983
Mitre link : CVE-2024-8983
CVE.ORG link : CVE-2024-8983
JSON object : View
Products Affected
smashballoon
- custom_twitter_feeds
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')