Description
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Twittee Text Tweet | ≤ 1.0.8 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting http/cves/2023/CVE-2023-0602.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/c357f93d-4f21-4cd9-9378-d97756c75255 exploit vdb-entry technical-description