Plugin inspection:

Twitter Hashtag Feed Widget

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Findings

  • Likely to be vulnerable to CVE-2011-5243

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

  • The plugin uses version v0.2.0-beta2 of the TwitterOAuth library. In addition to it being a beta release, it was released in 2009, and there is a known vulnerability in TwitterOAuth discovered in 2011: CVE-2011-5243
  • I could not find a proof-of-concept or list of affected versions for the CVE, but it seems likely that this version also includes the vulnerability

Failure criteria

  • Unsafe request processing

Read more about our failure criteria.