What is the CVSS score of CVE-2026-4089?

CVE-2026-4089 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Twittee Text Tweet CVE-2026-4089

EUVD-2026-24654 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24654

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1.0.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The ttt_twittee_tweeter() function uses extract() to pull shortcode attributes into local variables and then directly concatenates them into HTML output without any escaping. Specifically, the $id parameter is inserted into an HTML id attribute context without esc_attr(), allowing an attacker to break out of the attribute and inject arbitrary HTML event handlers. Additionally, the $tweet, $content, $balloon, and $theme attributes are similarly injected into inline JavaScript without escaping (lines 87, 93, 101, 117). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Twittee Text Tweet WordPress plugin versions up to 1.0.8 allows authenticated users with Contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes. The ttt_twittee_tweeter() function uses extract() to process shortcode parameters and concatenates them directly into HTML and inline JavaScript contexts without escaping, enabling attackers to break out of attribute contexts and inject event handlers that execute against site visitors. The vulnerability affects the 'id', 'tweet', 'content', 'balloon', and 'theme' parameters.

Technical ContextAI

The vulnerability stems from unsafe handling of WordPress shortcode attributes in the ttt_twittee_tweeter() function. The plugin uses PHP's extract() function to convert the $atts array into local variables, then concatenates these directly into HTML markup and inline JavaScript without applying WordPress escaping functions like esc_attr() or wp_json_encode(). The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs because user-supplied shortcode attributes are placed directly into both HTML attribute contexts (id parameter) and JavaScript contexts (tweet, content, balloon, theme parameters) without sanitization or output encoding. This is particularly dangerous for stored XSS because shortcode content is persisted in the WordPress database and executes against every user who views the affected page.

RemediationAI

The primary remediation is to update the Twittee Text Tweet plugin to a patched version if one is available from the plugin developer. If no patch has been released, administrators should immediately disable and remove the plugin from production environments until a security update is provided. As a compensating control, administrators can restrict the capability to use shortcodes to Administrators only (not Contributors) via code-level capability filtering or by using a capability management plugin, though this reduces functionality for legitimate contributors. WordPress administrators should also audit all pages and posts using [twittee] shortcodes to verify no malicious injections exist in the plugin's post meta. To prevent similar issues, enable security plugins that filter shortcode attributes or use a Web Application Firewall (WAF) to block requests containing JavaScript payloads in shortcode parameters. However, these controls are less effective than a patch and should only be interim measures.