WordPress Plugin Vulnerabilities

Custom Twitter Feeds (Tweets Widget) < 2.2 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
custom-twitter-feeds
Fixed in 2.2

References

CVE
CVE-2023-52136
URL
https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-tweets-widget-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
thiennv
Verified
No
WPVDB ID
a5a5ebc3-1c7d-4110-b7df-29c53fbf39c7

Timeline

Publicly Published
2023-12-28 (about 2 years ago)
Added
2024-01-04 (about 2 years ago)
Last Updated
2024-01-04 (about 2 years ago)

Other

Published
Title
Published
2025-01-24
Title
Ultimate Coming Soon & Maintenance < 1.1.0 - Cross-Site Request Forgery
Published
2025-06-13
Title
Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
Published
2024-07-11
Title
Google Adsense & Banner Ads by AdsforWP < 1.9.29 - Cross-Site Request Forgery
Published
2014-08-01
Title
DVS Custom Notification - Cross-Site Request Forgery
Published
2025-09-05
Title
WP Email Template <= 2.8.3 - Cross-Site Request Forgery