PT-2024-15931 · WordPress · The Advanced Social Feeds Widget & Shortcode

Name of the Vulnerable Software and Affected Versions: The Advanced Social Feeds Widget & Shortcode WordPress plugin versions 1.7 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admin...

BIT-GITLAB-2022-0093

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds...

PT-2024-15952 · WordPress · Widget For Social Page Feeds

Name of the Vulnerable Software and Affected Versions: Widget for Social Page Feeds WordPress plugin versions prior to 6.4 Description: The issue concerns the Widget for Social Page Feeds WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high...

WordPress Plugin Custom Twitter Feeds Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-18466 · WordPress · Friends

Name of the Vulnerable Software and Affected Versions: The Friends plugin for WordPress versions up to, and including, 2.8.5 Description: The issue allows authenticated attackers with administrator-level access and above to make web requests to arbitrary locations originating from the web...

Widget for Social Page Feeds < 6.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Create a new Facebook like widget. ...

Widget for Social Page Feeds < 6.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Create a new Facebook like...

CVE-2024-0379 Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctfautosavetokens function. This makes it possible for...

CVE-2024-0379

CVE-2024-0379 - CSRF in Custom Twitter Feeds (WordPress) up to version 2.2.1 stems from missing/incorrect nonce validation in the ctf_auto_save_tokens function. This allows unauthenticated attackers to forge requests and update a site’s Twitter API token and secret if the admin is duped into perf...

PT-2024-15513 · WordPress · Custom Twitter Feeds – A Tweets Widget/X Feed Widget

Name of the Vulnerable Software and Affected Versions: Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ctf auto sav...

[SECURITY] Fedora 38 Update: python-nikola-8.3.0-1.fc38

Nikola is a static site and blog generator using Python. It generates sites with tags, feeds, archives, comments, and more from plain text files. Source can be unformatted, or formatted with reStructuredText or Markdown. It also automatically builds image galleries...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0379 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 61a7033decfa Credits...

CVE-2023-52136

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

CVE-2023-52136

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

CVE-2023-52136

CVE-2023-52136 is a Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (also named Custom Twitter Feeds – A Tweets Widget or X Feed Widget). Affected: Custom Twitter Feeds plugin for WordPress, up to version 2.1.2. The related Wordfence entry confirms CSRF expos...

CVE-2023-52136 WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2...

PT-2024-14428 · Smash Balloon · Smash Balloon Custom Twitter Feeds

Name of the Vulnerable Software and Affected Versions: Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget versions through 2.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...

WordPress Plugin Custom Twitter Feeds Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-52136 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5f069383b9f0 Credit...