What the vulnerability does
01Description
The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function when rendering cached tweet text. The plugin's ctf_get_more_posts AJAX action is available to unauthenticated users and directly outputs cached tweet data through nl2br() without HTML escaping. When an attacker can get malicious content into cached tweet data (either by tweeting content that gets cached by the site's feed configuration, or through other vulnerabilities), the malicious HTML/JavaScript is executed when the unauthenticated endpoint is accessed. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
Custom Twitter Feeds plugin versions up to 2.5.4 contain a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into the site without user interaction. The vulnerability affects the scope beyond the plugin itself, potentially compromising visitor sessions and data. Site administrators should update to a version newer than 2.5.4 immediately.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in visitors' browsers and affects other parts of the site.
Potential impact on your site
04Site Impact
Visitors' sessions and data can be compromised; malicious scripts may steal credentials or redirect users.
Conditions required to exploit
05Prerequisites
None. The attacker needs only network access; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 13, 2026
CVE published
May 13, 2026
Record updated
