Marketing Twitter Bot WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Stored Cross-Site Scripting

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Marketing Twitter Bot WordPress plugin, affecting versions through 1.11. The vulnerability arises because the plugin lacks proper CSRF checks in certain areas and fails to adequately sanitize and escape user input. This could enable attackers to exploit logged-in administrators by injecting Stored Cross-Site Scripting (XSS) payloads through a CSRF attack.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, which could be used to inject Stored Cross-Site Scripting payloads that would be executed in the context of the user.