plugin

Tweet Wheel Vulnerabilities

2 known security issues reported for the Tweet Wheel WordPress plugin. Most recent disclosed Apr 21, 2016.

2 medium

Running Tweet Wheel on your site? Check whether your installed version is affected.

Scan your site free

Tweet Wheel < 1.0.3.3 - Reflected Cross-Site Scripting

medium

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.

CVSS:
6.1
Affected:
up to 1.0.3.3
Fixed in:
1.0.3.3
Disclosed:
Apr 21, 2016

CVE-2016-10986 on NVD →

Tweet Wheel <= 0.2 - Missing Authorization Checks

medium

The Tweet Wheel plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 0.2. This is due to several functions called via AJAX actions missing proper capability and nonce checks. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to spa...

CVSS:
4.3
Affected:
up to 0.2
Fixed in:
0.3
Disclosed:
Mar 7, 2015

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database