Custom Twitter Feeds <= 2.11.0 - Unauthenticated Stored Cross-Site Scripting via 'atts' Parameter
- ID
- WPSEC-2026-2389
- Plugin
- Custom Twitter Feeds – A Tweets Widget or X Feed Widget (custom-twitter-feeds)
- Affected
- from 2.0 before 2.11.1
- Remediation
- Update to 2.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Custom Twitter Feeds on WPSec AttackSurface
- Fix released
- Published
Description
The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atts' parameter of the public ctf_background_processing AJAX action in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. The sanitized attributes were discarded, so an attacker-supplied feed value was stored as a feed cache ID, copied into the cron report and rendered as HTML on the plugin's admin Support page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the Support page.
References
- https://wpsec.com/vuln/WPSEC-2026-2389/
- https://plugins.svn.wordpress.org/custom-twitter-feeds/tags/2.11.1/
- https://wordpress.org/plugins/custom-twitter-feeds/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS