Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Dachande663 Clear all filters
TI-2024-03386 CVE-2024-3631 · GHSA-5wq8-45w5-cxgr

HL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRF

Priority MEDIUM 53

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00211 Published 2024-05-15 No fix listed CWE-352
TI-2024-03385 CVE-2024-3630 · GHSA-vvgm-85j8-2648

HL Twitter <= 2014.1.18 - Admin+ Stored XSS via Widget

Priority LOW 24

The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00331 Published 2024-05-15 No fix listed CWE-79
TI-2024-03384 CVE-2024-3629 · GHSA-p3vp-jg8v-gfmh

HL Twitter <= 2014.1.18 - Settings Update via CSRF

Priority LOW 12

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00204 Published 2024-05-15 No fix listed CWE-352