Unscored severity · published Oct 9, 2012
CVE-2012-5349
Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVSS
3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pay-with-tweet · Wordpress
through 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5349
Vendor Advisory
http://secunia.com/advisories/47475
wordpress.org
http://wordpress.org/extend/plugins/pay-with-tweet/changelog/
Exploit
http://www.exploit-db.com/exploits/18330
www.osvdb.org
http://www.osvdb.org/78205
Exploit
http://www.securityfocus.com/bid/51308
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/72166
More from Pay-with-tweet
–
CVE-2012-5350
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via…