WordPress Plugin Vulnerabilities

Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts.

Affects Plugins

Plugin icon
twitter-friends-widget
No known fix

References

CVE
CVE-2021-38322
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38322

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
p7e4
Verified
No
WPVDB ID
60180749-85cd-4af7-85f9-75c882659915

Timeline

Publicly Published
2021-09-08 (about 4 years ago)
Added
2021-09-09 (about 4 years ago)
Last Updated
2022-04-09 (about 4 years ago)

Other

Published
Title
Published
2023-03-15
Title
WSB Brands < 1.2 - Admin+ Stored XSS
Published
2024-03-25
Title
Master Addons for Elementor < 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-15
Title
WP Armour < 2.1.14 - Reflected XSS
Published
2025-12-05
Title
Envo Extra < 1.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-02-16
Title
Link Whisper Free < 0.9.3 - Reflected Cross-Site Scripting