CVE-2023-52136

2024-01-0509:15:09

CWE-352

[email protected]

web.nvd.nist.gov

cve-2023-52136

cross-site request forgery

smash balloon custom twitter feeds

tweets widget

x feed widget

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.

Affected configurations

Nvd

Node

smashballooncustom_twitter_feedsRange≤2.1.2wordpress

VendorProductVersionCPE
smashballooncustom_twitter_feeds*cpe:2.3:a:smashballoon:custom_twitter_feeds:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
smashballoon	custom_twitter_feeds	*	cpe:2.3:a:smashballoon:custom_twitter_feeds::::::wordpress::*

References

patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-tweets-widget-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve