# Custom Twitter Feeds <= 2.11.0 - Unauthenticated Stored Cross-Site Scripting via 'atts' Parameter

- **ID:** WPSEC-2026-2389
- **Plugin:** Custom Twitter Feeds – A Tweets Widget or X Feed Widget (`custom-twitter-feeds`), https://wordpress.org/plugins/custom-twitter-feeds/
- **Affected versions:** from 2.0 before 2.11.1
- **Fixed in:** 2.11.1 (Update to 2.11.1 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/custom-twitter-feeds
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2389/

## Description

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atts' parameter of the public ctf_background_processing AJAX action in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. The sanitized attributes were discarded, so an attacker-supplied feed value was stored as a feed cache ID, copied into the cron report and rendered as HTML on the plugin's admin Support page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the Support page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2389/
- https://plugins.svn.wordpress.org/custom-twitter-feeds/tags/2.11.1/
- https://wordpress.org/plugins/custom-twitter-feeds/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2389/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.