Description
Cross-Site Request Forgery (CSRF) vulnerability in krolow Twitter Post twitterpost allows Stored XSS.This issue affects Twitter Post: from n/a through <= 0.1.
Published: 2025-01-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

WordPress Twitter Post plugin version 0.1 or earlier contains a Cross‑Site Request Forgery (CSRF) flaw that allows malicious code to be stored and later executed when visitors view affected content, resulting in stored cross‑site scripting (XSS). The CVE description does not specify whether the attack requires an authenticated user; that detail is inferred from typical CSRF mechanisms but is not confirmed by the official record.

Affected Systems

Any WordPress site that has the krolow Twitter Post plugin installed at version 0.1 or earlier is affected. No other vendor products or newer plugin versions are listed as impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity impact once the flaw is used successfully. The EPSS score of less than 1% suggests that real‑world exploitation is currently uncommon, and the vulnerability does not appear in the CISA KEV catalog. The flaw permits the storage of malicious scripts that are executed when site visitors view the affected content.

Generated by OpenCVE AI on May 2, 2026 at 11:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Twitter Post plugin to the latest version that removes the CSRF vulnerability.
  • Modify the plugin’s form handlers to validate a CSRF token on every authenticated POST or edit action.
  • Ensure that all user‑supplied content is properly sanitized or escaped before storing or rendering it to prevent script execution.

Generated by OpenCVE AI on May 2, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3318 Cross-Site Request Forgery (CSRF) vulnerability in Vinícius Krolow Twitter Post allows Stored XSS.This issue affects Twitter Post: from n/a through 0.1.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Vinícius Krolow Twitter Post allows Stored XSS.This issue affects Twitter Post: from n/a through 0.1. Cross-Site Request Forgery (CSRF) vulnerability in krolow Twitter Post twitterpost allows Stored XSS.This issue affects Twitter Post: from n/a through <= 0.1.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Fri, 17 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Vinícius Krolow Twitter Post allows Stored XSS.This issue affects Twitter Post: from n/a through 0.1.
Title WordPress Twitter Post plugin <= 0.1 - CSRF to Stored XSS vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:16.084Z

Reserved: 2025-01-16T11:27:51.184Z

Link: CVE-2025-23654

cve-icon Vulnrichment

Updated: 2025-01-17T17:20:25.396Z

cve-icon NVD

Status : Deferred

Published: 2025-01-16T20:15:42.607

Modified: 2026-06-17T08:56:07.763

Link: CVE-2025-23654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T11:30:41Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)