PT-2024-33638 · Smash Balloon · Smash Balloon Custom Twitter Feeds

Name of the Vulnerable Software and Affected Versions: Smash Balloon Custom Twitter Feeds Tweets Widget versions through 2.2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into...

Minor update for Vivaldi Desktop Browser 7.0

Download Vivaldi The following improvements were made since the initial 7.0 stable release: Chromium Upgraded to 130.0.6723.96 CVE-2024-10487, CVE-2024-10488 Crash With Trash in Sessions Panel VB-110788 FeedsmacOS Can't rename top-level feed VB-110618 Keyboard Focus Next/Prev pane no longer...

WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.2.3...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49685 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c19e764fedf7 Credits...

WordPress Custom Twitter Feeds plugin < 2.2.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Custom Twitter Feeds Tweets Widget versions 2.2.3...

CVE-2024-8983

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8983

The Custom Twitter Feeds WordPress plugin (also known as Tweets Widget) is vulnerable to a Stored Cross-Site Scripting (XSS) attack in versions before 2.2.3 . The root cause is the failure to sanitize and escape certain settings, which allows high-privilege users, such as administrators, to injec...

CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS

Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts...

WordPress plugin Custom Twitter Feeds 命令注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A command injection...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin < 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions 2.2.3 Fixed in 2.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8983 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3fd03697ab47 Credits Krugov...

CVE-2024-8983: Improper Neutralization of Special Elements used in a Command

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-39351

Name of the Vulnerable Software and Affected Versions: Custom Twitter Feeds WordPress plugin versions prior to 2.2.3 Description: The issue allows high privilege users to inject scripts due to the plugin not filtering some of its settings. Recommendations: For versions prior to 2.2.3, update to...

CVE-2024-6621

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...

PT-2024-37752 · WordPress · The Rss Aggregator

Name of the Vulnerable Software and Affected Versions: The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to, and including, 4.23.11 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify dat...

WordPress Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Feeds for YouTube versions = 2.2.1...

CVE-2024-6256

The Feeds for YouTube YouTube video, channel, and gallery plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-6256

The Feeds for YouTube YouTube video, channel, and gallery plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-6256 Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Feeds for YouTube YouTube video, channel, and gallery plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-6256 Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Feeds for YouTube YouTube video, channel, and gallery plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...