CVE-2015-4557

Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.

• CWE-79

• http://packetstormsecurity.com/files/132432/WordPress-Nextend-Twitter-Connect-1.5.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jun/71Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/75395Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/1178744/nextend-twitter-connectThird Party Advisory
• http://packetstormsecurity.com/files/132432/WordPress-Nextend-Twitter-Connect-1.5.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jun/71Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/75395Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/1178744/nextend-twitter-connectThird Party Advisory

Published

Apr 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4551LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 …
• CVE-2015-4552Cross-site scripting (XSS) vulnerability in the quick edit f…
• CVE-2015-4553A file upload issue exists in DeDeCMS before 5.7-sp1, which …8.8
• CVE-2015-4554Multiple unspecified vulnerabilities in TIBCO Spotfire Clien…
• CVE-2015-4555Buffer overflow in the HTTP administrative interface in TIBC…
• CVE-2015-4556The string-translate* procedure in the data-structures unit …
• CVE-2015-4559Cross-site scripting (XSS) vulnerability in the product depl…
• CVE-2015-4582The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for…6.1
• CVE-2015-4586Cross-site request forgery (CSRF) vulnerability in Alcatel-L…
• CVE-2015-4587Cross-site scripting (XSS) vulnerability in the Alcatel-Luce…
• CVE-2015-4588Heap-based buffer overflow in the DecodeImage function in li…
• CVE-2015-4590The extractFrom function in Internals/QuotedString.cpp in Ar…