CVE-2012-5349: Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allo...

Security readout for executives and security teams

This CVE affects older Pay With Tweet plugin deployments. A remote attacker could inject script or HTML through pay.php parameters, creating cross-site scripting risk for users who visit a crafted or vulnerable plugin page. The sources do not provide CVSS scoring or confirm active exploitation. Exposure is most likely on WordPress sites that still run the Pay With Tweet plugin before version 1.2 and leave pay.php reachable. Organizations not using this plugin are unlikely to be affected based on the provided sources. Treat this as a targeted cleanup item for legacy WordPress exposure, not an emergency unless the plugin is internet-facing and still below 1.2. Prioritize inventory and removal or upgrade because public exploit knowledge exists. Mitigation focus: Inventory WordPress sites for the Pay With Tweet plugin.; Upgrade the plugin to version 1.2 or current vendor-supported guidance.; Remove the plugin if it is unused or unsupported..

Prepared

Jun 27, 2026, 16:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.