4.3
Medium
CVE-2025-1314 The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request…
Description
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Custom Twitter Feeds – A Tweets Widget or X Feed Widget 2.2 | earliest → 2.2.5 | No fix stated |
Other CVEs of Custom Twitter Feeds – A Tweets Widget or X Feed Widget
The 4 CVEs of Custom Twitter Feeds – A Tweets Widget or X Feed Widget →
CVE-2026-84909
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Medium
CVE-2026-6177
The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and…
7.2
High
CVE-2024-0379
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request…
4.3
Medium