CVE-2024-3630

2024-05-1506:15:12

[email protected]

web.nvd.nist.gov

hl twitter

wordpress

cross-site scripting

stored

vulnerable

cve-2024-3630

AI Score

5.4

Confidence

High

EPSS

Percentile

9.0%

JSON

The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)