Smashballoon Custom Twitter Feeds vulnerabilities
5 vulnerabilities
Known vulnerabilities in Smashballoon Custom Twitter Feeds, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2022-33974smash balloon · custom twitter feeds (tweets widget) +2 moreWordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.EPSS0.25%MediumCVE-2024-0379smashballoon · custom_twitter_feeds +2 moreCustom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options UpdateThe Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthenticated attackers to update the site's twitter API token and secret via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS1.00%HighCVE-2024-49685smashballoon · custom_twitter_feeds +2 moreWordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through <= 2.2.3.EPSS0.20%MediumCVE-2024-8983smashballoon · custom_twitter_feeds +2 moreCustom Twitter Feeds < 2.2.3 - Admin+ Stored XSSCustom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.43%HighCVE-2023-52136smash balloon · custom twitter feeds – a tweets widget or x feed widget +2 moreWordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.EPSS0.22%