CVE-2014-2559
Twitget < 3.3.1 - Cross-Site Request Forgery via Plugin Options Change
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2559.
AI-analyzed exploit summary The exploit demonstrates a CSRF/XSS vulnerability in Twitget 3.3.1 by crafting a malicious form that updates plugin options without proper nonce validation, leading to stored XSS via unescaped output in the form.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
Exploits (1)
The exploit demonstrates a CSRF/XSS vulnerability in Twitget 3.3.1 by crafting a malicious form that updates plugin options without proper nonce validation, leading to stored XSS via unescaped output in the form.