Stored Cross-Site Scripting in Custom Twitter Feeds Tweet Text Output

Tweet text was echoed into the page without filtering, so markup coming back from the feed was rendered as HTML and could execute script in the browser of any visitor viewing the feed. The text is now passed through wp_kses_post before output.

This vulnerability affects the following application versions:

• Custom Twitter Feeds 2.0
• Custom Twitter Feeds 2.0.1
• Custom Twitter Feeds 2.0.2
• Custom Twitter Feeds 2.0.3
• Custom Twitter Feeds 2.0.4
• Custom Twitter Feeds 2.0.5
• Custom Twitter Feeds 2.0.6
• Custom Twitter Feeds 2.0.7
• Custom Twitter Feeds 2.1
• Custom Twitter Feeds 2.1.1
• Custom Twitter Feeds 2.1.2
• Custom Twitter Feeds 2.2
• Custom Twitter Feeds 2.2.1
• Custom Twitter Feeds 2.2.2
• Custom Twitter Feeds 2.2.3
• Custom Twitter Feeds 2.2.4
• Custom Twitter Feeds 2.2.5
• Custom Twitter Feeds 2.3.0
• Custom Twitter Feeds 2.3.1
• Custom Twitter Feeds 2.5.4