What is the CVSS score of CVE-2026-1911?

CVE-2026-1911 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1911?

Organizations using all should be aware of moderate risk from CVE-2026-1911, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1911?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1911

EUVD-2026-14166 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-rc8f-4gxr-4cfh

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14166

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Twitter Feeds plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'tweet_title' parameter of the TwitterFeeds shortcode due to insufficient input sanitization and output escaping. All versions up to and including 1.0.0 are affected, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that persists in pages and executes for all users who view the compromised content. With a CVSS score of 6.4 (Medium) and CWE-79 classification, this vulnerability poses a meaningful risk to WordPress sites using this plugin, particularly those with permissive user role assignments.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting). The Twitter Feeds plugin (CPE: cpe:2.3:a:viaviwebtech:twitter_feeds:*:*:*:*:*:*:*:*), developed by Viaviwebtech, processes user-supplied input via the TwitterFeeds shortcode without proper sanitization before storage in the WordPress database or escaping upon output to the page. Analysis of the vulnerable code at twitter-feeds.php line 490 (visible in both trunk and version 1.0.0 branches) reveals that the 'tweet_title' parameter is directly incorporated into page content without applying WordPress security functions like sanitize_text_field() during input handling or esc_html() / wp_kses_post() during output rendering, enabling script injection.

RemediationAI

Immediately disable and remove the Twitter Feeds plugin if no security update is available, or upgrade to the latest patched version once released by Viaviwebtech. If the plugin remains in use pending a vendor patch, restrict the ability to use shortcodes and create/edit posts containing the TwitterFeeds shortcode to administrators only by removing Contributor and Editor roles' capability to publish posts with custom shortcodes, or by filtering shortcode execution via the 'do_shortcode' hook. Conduct a thorough audit of all posts and pages containing the TwitterFeeds shortcode to identify and remove any injected malicious scripts. Review access logs and user activity for any Contributor or Editor accounts that may have been compromised. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cb725044-01c3-4c0c-b276-291f897f11e7?source=cve for the latest patch status and additional mitigation recommendations.