Unscored severity · published Oct 17, 2014
CVE-2014-2995
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twitget · Twitget Project
through 3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2995
Exploit
http://packetstormsecurity.com/files/126134
Exploit
http://seclists.org/fulldisclosure/2014/Apr/172
Vendor Advisory
http://wordpress.org/plugins/twitget/changelog
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/92392
Exploit
https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1
More from Twitget
–
CVE-2014-2559
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of…