Easy Twitter Feed <= 1.1 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability

Contributor

Published
2021-09-19

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode.

CVE

https://www.cve.org/CVERecord?id=CVE-2021-24413

CVSS

Score:6.9

Severity:Medium

Version: 1.1

There is a patch available in v1.2 and we strongly recommend you update to this version as soon as possible.