CVE-2024-0379

CVE-2024-0379 - CSRF in Custom Twitter Feeds (WordPress) up to version 2.2.1 stems from missing/incorrect nonce validation in the ctf_auto_save_tokens function. This allows unauthenticated attackers to forge requests and update a site’s Twitter API token and secret if the admin is duped into perf...

CVE-2024-49685

CVE-2024-49685 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin for WordPress, affecting versions up to 2.2.3. The issue enables CSRF without requiring authentication and is exploitable in affected environments, potential...

CVE-2024-8983

The Custom Twitter Feeds WordPress plugin (also known as Tweets Widget) is vulnerable to a Stored Cross-Site Scripting (XSS) attack in versions before 2.2.3 . The root cause is the failure to sanitize and escape certain settings, which allows high-privilege users, such as administrators, to injec...

CVE-2022-33974

The CVE-2022-33974 entry concerns the WordPress plugin Smash Balloon Custom Twitter Feeds (Tweets Widget) with versions

CVE-2023-52136

CVE-2023-52136 is a Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (also named Custom Twitter Feeds – A Tweets Widget or X Feed Widget). Affected: Custom Twitter Feeds plugin for WordPress, up to version 2.1.2. The related Wordfence entry confirms CSRF expos...