What is the CVSS score of CVE-2026-6177?

CVE-2026-6177 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Custom Twitter Feeds are affected by CVE-2026-6177?

Custom Twitter Feeds plugin for WordPress (versions ≤2.5.4) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript into cached tweet…

How to fix or mitigate CVE-2026-6177?

24 hours: Identify all WordPress installations using Custom Twitter Feeds plugin ≤2.5.4 via plugin inventory audit. 7 days: Disable or remove the Custom Twitter Feeds plugin immediately if update is unavailable; evaluate alternative Twitter feed solutions. 30 days: Monitor Wordfence and plugin developer channels for release of version 2.5.5 or later; apply update immediately upon availability. If plugin remains in use pending patch, implement WAF rule blocking requests to ctf_get_more_posts AJAX endpoint.

Custom Twitter Feeds CVE-2026-6177

EUVD-2026-29945 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 Wordfence

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 13:16 vuln.today

CVE Published

May 13, 2026 - 12:29 nvd

HIGH 7.2

DescriptionCVE.org

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function when rendering cached tweet text. The plugin's ctf_get_more_posts AJAX action is available to unauthenticated users and directly outputs cached tweet data through nl2br() without HTML escaping. When an attacker can get malicious content into cached tweet data (either by tweeting content that gets cached by the site's feed configuration, or through other vulnerabilities), the malicious HTML/JavaScript is executed when the unauthenticated endpoint is accessed. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected endpoint.

AnalysisAI

Stored cross-site scripting in Custom Twitter Feeds plugin for WordPress versions ≤2.5.4 allows unauthenticated remote attackers to execute arbitrary JavaScript when malicious content enters cached tweet data. The vulnerability stems from the ctf_get_more_posts AJAX endpoint outputting cached tweet text through nl2br() without HTML escaping, accessible without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Attack requires either posting malicious tweets that the target site caches via its feed configuration, or leveraging other vulnerabilities to poison the tweet cache. No active exploitation confirmed at time of analysis. Wordfence identified the flaw with patch available in changeset 3519584.

Technical ContextAI

This vulnerability affects the Custom Twitter Feeds WordPress plugin (CPE: cpe:2.3:a:smub:custom_twitter_feeds_-_a_tweets_widget_or_x_feed_widget), which caches and displays Twitter/X feed content. The flaw exists in CTF_Display_Elements::get_post_text() function where cached tweet text is processed through PHP's nl2br() function for line break conversion but lacks HTML entity encoding before output. The ctf_get_more_posts AJAX action (custom-twitter-feed.php line 447) is registered for both authenticated and unauthenticated users (wp_ajax_nopriv_ctf_get_more_posts), directly rendering cached data without sanitization. This represents a classic stored XSS vulnerability (CWE-79) where untrusted data from an external source (Twitter API responses) is stored in the plugin's cache and later output without proper escaping. The item.php template (line 36) consumes this unsanitized output, creating the execution pathway. The scope change (S:C) in the CVSS vector indicates the vulnerable component (plugin) differs from the impacted component (user browsers accessing any page with the vulnerable endpoint).

RemediationAI

Update Custom Twitter Feeds plugin to version 2.5.5 or later, which implements proper HTML escaping in the affected output functions (patch details in changeset 3519584: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3519584%40custom-twitter-feeds&old=3481416%40custom-twitter-feeds). Until patching is possible, implement these compensating controls with noted trade-offs: (1) Disable the plugin entirely if Twitter feed functionality is non-critical-eliminates risk but removes all feed display features. (2) Restrict which Twitter accounts the plugin caches by reviewing feed configuration settings and only following verified/trusted accounts-reduces attack surface but doesn't eliminate risk if those accounts are compromised. (3) Implement Web Application Firewall (WAF) rules to inspect and sanitize responses from the ctf_get_more_posts AJAX endpoint-adds performance overhead and may cause false positives blocking legitimate content with HTML-like characters. (4) Use Content Security Policy (CSP) headers with strict script-src directives to prevent inline JavaScript execution-provides defense-in-depth but may break other legitimate WordPress plugins or themes that rely on inline scripts. Note that disabling AJAX endpoints via functions.php could break feed loading functionality entirely. Prioritize upgrading to patched version for production environments.