Twitter Cards Meta Vulnerabilities

The Twitter Cards Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the twitter_card_type metadata added to posts in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on the user supplied value. This makes it possible for authenticated attackers wit...

CVSS:

6.4

Affected:

up to 2.9.1

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

The Twitter Cards Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the twitter_card_type metadata added to posts in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on the user supplied value. This makes it possible for authenticated attackers wit...

Affected:

up to 2.9.1

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

No patched version available. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Twitter Cards Meta Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be execute...

Affected:

up to 2.9.1

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

[en] The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Aug 12, 2019

CVE-2017-18504 on NVD →

[en] The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Aug 12, 2019

CVE-2017-18503 on NVD →

The Twitter Cards Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.5. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to gain administrative privileges and execute otherwise restricted actions via a for...

CVSS:

8.8

Affected:

up to 2.4.5

Fixed in:

2.5.0

Disclosed:

Apr 6, 2017

CVE-2017-18504 on NVD →

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS via several parameters.

CVSS:

6.1

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Apr 6, 2017

CVE-2017-18503 on NVD →

WordPress Twitter Cards Meta plugin Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) were found in 2.4.5 version. When the plugins settings are saved to the database and outputted there is no escaping done. Also, it's missing a nonce to check the request after saving the plugin's settings. Update the plugi...

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Dec 9, 2016