Source	Link
blog	www.blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717
packetstormsecurity	www.packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html
github	www.github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d
securityfocus	www.securityfocus.com/bid/57569
seclists	www.seclists.org/fulldisclosure/2013/Jan/251
secunia	www.secunia.com/advisories/52007
github	www.github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334
openwall	www.openwall.com/lists/oss-security/2013/01/29/4

Parameter	Position	Path	Description	CWE
params[twitter_username]	query param	/action/widgets/save	Cross-site scripting (XSS) vulnerability in Twitter widget allowing injection of arbitrary web script or HTML.	CWE-79

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

02 Feb 2014 20:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS24.3

EPSS0.00461

CWE-79