{"api_version":"1","generated_at":"2026-07-23T06:46:34+00:00","cve":"CVE-2014-2995","urls":{"html":"https://cve.report/CVE-2014-2995","api":"https://cve.report/api/cve/CVE-2014-2995.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2995","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2995"},"summary":{"title":"CVE-2014-2995","description":"Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-10-17 22:55:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"3.5","severity":"","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1","name":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"CSRF/XSS vulnerability in Twitget 3.3.1 – dxw advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/126134","name":"http://packetstormsecurity.com/files/126134","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Twitget 3.3.1 Cross Site Request Forgery / Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://wordpress.org/plugins/twitget/changelog","name":"http://wordpress.org/plugins/twitget/changelog","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"WordPress › Twitget « WordPress Plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Apr/172","name":"http://seclists.org/fulldisclosure/2014/Apr/172","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92392","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92392","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2995","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2995","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2995","vulnerable":"1","versionEndIncluding":"3.3.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"twitget_project","cpe5":"twitget","cpe6":"*","cpe7":"-","cpe8":"-","cpe9":"-","cpe10":"-","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:28:46.386Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://wordpress.org/plugins/twitget/changelog"},{"name":"twitget-wordpress-xss(92392)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92392"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/126134"},{"name":"20140411 CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Apr/172"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://wordpress.org/plugins/twitget/changelog"},{"name":"twitget-wordpress-xss(92392)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92392"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/126134"},{"name":"20140411 CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Apr/172"},{"tags":["x_refsource_MISC"],"url":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-2995","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://wordpress.org/plugins/twitget/changelog","refsource":"CONFIRM","url":"http://wordpress.org/plugins/twitget/changelog"},{"name":"twitget-wordpress-xss(92392)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92392"},{"name":"http://packetstormsecurity.com/files/126134","refsource":"MISC","url":"http://packetstormsecurity.com/files/126134"},{"name":"20140411 CSRF/XSS vulnerability in Twitget 3.3.1 (WordPress plugin)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Apr/172"},{"name":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1","refsource":"MISC","url":"https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-2995","datePublished":"2014-10-17T22:00:00.000Z","dateReserved":"2014-04-24T00:00:00.000Z","dateUpdated":"2024-08-06T10:28:46.386Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-17 22:55:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:twitget_project:twitget:*:-:-:-:-:wordpress:*:*","versionEndIncluding":"3.3.1","matchCriteriaId":"2A92F729-520E-4903-B25A-A17C6B3F9653"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2995","Ordinal":"1","Title":"CVE-2014-2995","CVE":"CVE-2014-2995","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2995","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to wp-admin/options-general.php.","Type":"Description","Title":"CVE-2014-2995"},{"CveYear":"2014","CveId":"2995","Ordinal":"2","NoteData":"2014-10-17","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2995","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}