CVE-2014-2995
twitget < 3.3.1 - Authenticated Cross-Site Scripting via twitget_consumer_key Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2995. PoCs published by Tom Adams.
AI-analyzed exploit summary This PoC demonstrates a CSRF/XSS vulnerability in Twitget 3.3.1. It exploits the lack of nonce-checking and unescaped output in the plugin's options form, allowing an attacker to inject malicious scripts via a crafted form submission.
Description
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Exploits (1)
This PoC demonstrates a CSRF/XSS vulnerability in Twitget 3.3.1. It exploits the lack of nonce-checking and unescaped output in the plugin's options form, allowing an attacker to inject malicious scripts via a crafted form submission.