CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.
Explanation of Vulnerability in Simple Terms
Custom Twitter Feeds plugin for WordPress versions up to 2.1.2 is vulnerable to cross-site request forgery (CSRF). An attacker can trick a logged-in site administrator into performing unwanted actions, such as changing plugin settings or modifying feed configurations. The vulnerability requires the admin to visit a malicious webpage while authenticated to the WordPress site.
What an attacker can do
Trick an authenticated admin into changing plugin settings or feed configurations without their knowledge.
Potential impact on your site
Plugin settings or Twitter feed configurations could be altered by an attacker without your consent or knowledge.
Conditions required to exploit
Admin must be logged into WordPress and visit an attacker-controlled webpage while authenticated.
Key dates
External resources
Related vulnerabilities
