What the vulnerability does
01Description
A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function twttr_settings_page of the file twitter.php. The manipulation of the argument twttr_url_twitter/bws_license_key/bws_license_plugin leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The patch is named e04d59ab578316ffeb204cf32dc71c0d0e1ff77c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230155.
Explanation of Vulnerability in Simple Terms
02Summary
The Twitter Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 1.3.0 and earlier. An authenticated administrator with high privileges can inject malicious scripts through plugin settings. When other users view affected pages, the injected code executes in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires administrator interaction to exploit.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that executes when other users view the site.
Potential impact on your site
04Site Impact
Malicious scripts can steal admin session cookies or redirect users to phishing sites.
Conditions required to exploit
05Prerequisites
Attacker must have administrator privileges and trick an admin into visiting a malicious page.
Key dates
06Disclosure timeline
May 31, 2023
CVE published
March 5, 2025
Record updated
