Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Smash Balloon Component: Custom Twitter Feeds Clear all filters
TI-2024-33171 CVE-2024-49685 · GHSA-jrrv-7qxg-9qwh

WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Priority LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00202 Published 2024-10-31 No fix listed CWE-352
TI-2024-08341 CVE-2024-8983 · GHSA-3v5j-fcwv-g4wv

Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS

Priority MEDIUM 55

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfi…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00432 Published 2024-10-08 Fixed in 2.2.3 CWE-77
TI-2023-28575 CVE-2023-52136 · GHSA-fmvv-rrvc-rh7f

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Priority LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00223 Published 2024-01-05 No fix listed CWE-352