CVE-2024-8983: 
WordPress vulnerability analysis and mitigation

The Custom Twitter Feeds WordPress plugin versions before 2.2.3 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on September 17, 2024, and was assigned CVE-2024-8983. The issue affects the plugin settings functionality where high privilege users can inject malicious scripts (WPScan).

The vulnerability stems from insufficient filtering of plugin settings, specifically in the Feeds section where users with administrative privileges can inject malicious JavaScript code. The vulnerability has been assigned a CVSS v3.1 score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with high privileges required (NIST NVD).

When exploited, this vulnerability allows high-privilege users to inject malicious scripts that can execute when other users visit pages containing the Twitter feed. This could potentially lead to unauthorized actions being performed in the context of the victim's browser session (WPScan).

The vulnerability has been patched in version 2.2.3 of the Custom Twitter Feeds plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).