CVE-2024-10116: Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10116?
CVE-2024-10116 is classified as a high severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-10116?
The fix for CVE-2024-10116 is to update the Twitter Follow Button plugin for WordPress to version 0.3 or later.
Who is affected by CVE-2024-10116?
CVE-2024-10116 affects all users of the Twitter Follow Button plugin for WordPress versions up to and including 0.2.
What types of attacks can exploit CVE-2024-10116?
CVE-2024-10116 can be exploited to perform stored cross-site scripting attacks on websites using the vulnerable plugin.
Is user authentication required to exploit CVE-2024-10116?
Yes, the exploitation of CVE-2024-10116 requires an authenticated attacker to leverage the vulnerability.