CVE-2017-18504

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF...

EUVD-2017-9619

Malware in sbrugna...

EUVD-2017-9620

Malware in sbrugna...

CVE-2017-18503

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...

WordPress Twitter Cards Meta Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Twitter Cards Meta Type Plugin Vulnerable versions = 2.9.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 2f6fcb189392 Credits N/A Required privilege...

WordPress twitter-cards-meta plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. twitter-cards-meta plugin is a Twitter account information display plugin used in it. A cross-site scripting vulnerability exists in...

WordPress twitter-cards-meta plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. twitter-cards-meta plugin is a Twitter account information display plugin used in it. A cross-site request forgery vulnerability exist...

CVE-2017-18504

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF...

CVE-2017-18503

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...

CVE-2017-18503

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...

Cross site scripting

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...

Cross site request forgery (csrf)

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF...

CVE-2017-18503

The CVE-2017-18503 entry concerns the WordPress Twitter Cards Meta plugin (pre-2.5.0). The connected sources confirm a cross-site scripting (XSS) vulnerability in versions prior to 2.5.0 caused by insufficient validation of client-side data. Impact described as enabling attacker‑controlled script...

CVE-2017-18503

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS...

CVE-2017-18504

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF...

CVE-2017-18504

CVE-2017-18504 affects the WordPress Twitter Cards Meta plugin prior to version 2.5.0. The connected sources consistently state a cross-site request forgery (CSRF) vulnerability in this plugin, indicating that an attacker could exploit CSRF to perform unintended actions on behalf of an authentica...

Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Twitter Cards Meta

We recently found that the Twitter Cards Meta contains a cross-site request forgery CSRF/cross-site scripting XSS vulnerability on the plugin’s setting pages,/wp-admin/admin.php?page=twitter-cards-meta. The CSRF potion of the vulnerability was due to a lack of a nonce on the page and a lack of a...