Twitter cross-site scripting flaw 'still not fixed'

A potentially critical cross-site scripting vulnerability in Twitter has still not been fixed, according to the researcher who discovered the problem.

Search marketing professional James Slater claimed that the vulnerability in the popular micro-blogging site could allow hackers to insert malicious JavaScript into tweets.

"With a few minutes' work, someone with a bit of technical expertise could make a Twitter 'application' and start sending tweets with it," he wrote in a blog post.

"Using the simple instructions below, it can be arranged so that if another Twitter user so much as sees one of these tweets - and they are logged in to Twitter - their account could be taken over."

Despite Twitter promising to fix the problem after being notified by Naylor on Tuesday, the firm's IT team has "completely missed the point", he wrote.

"This isn't the first time we've found vulnerabilities in Twitter. I wonder how many more there are out there?" he added.

"We got no response from them yesterday either, which is a shame. We don't want to stop using their service because we're worried about security, and I'm sure we're not the only ones."

Twitter has yet to officially respond to the news, although many of the comments left on Naylor's blog posting point to the flaw being a "rookie error".