nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-8983 CVE-2024-8983
MEDIUM
Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
Record summary
CVE-2024-8983 has a selected CVSS score of 4.8 (medium).
Description
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 9, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Custom Twitter FeedsDefault status: unaffected | CVE List | Before 2.2.3 | affected |
custom_twitter_feedsBrowse smashballoon / custom_twitter_feedsDefault status: unknown | CVE List | Before 2.2.3 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33