PT-2023-10171 · Bestwebsoft · Bestwebsoft Twitter Plugin

Published

2023-05-31

·

Updated

2024-05-17

·

CVE-2014-125103

CVSS v2.0
3.3
VectorAV:N/AC:L/Au:M/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions BestWebSoft Twitter Plugin versions up to 1.3.2
Description A vulnerability was found in the BestWebSoft Twitter Plugin. It affects the function 
twttr settings page
of the file 
twitter.php
. The manipulation of the argument 
twttr url twitter/bws license key/bws license plugin
leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 1.3.7 is able to address this issue.
Recommendations For BestWebSoft Twitter Plugin versions up to 1.3.2, upgrade to version 1.3.7 to address the issue. As a temporary workaround, consider disabling the 
twttr settings page
function until a patch is available. Restrict access to the 
twitter.php
file to minimize the risk of exploitation. Avoid using the argument 
twttr url twitter/bws license key/bws license plugin
in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-125103

Affected Products

Bestwebsoft Twitter Plugin