EUVD-2026-82731
GHSA-9fp7-mwxw-94ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor-level WordPress account
-
DeliveryInsert Twitter feed shortcode with malicious buttoncolor attribute
-
ExploitPayload stored unsanitized via legacy shortcode path
-
ExecutionHigher-privileged user views injected page
-
PersistScript executes in victim browser (scope change)
-
ImpactSession/action abuse in admin context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with contributor-level capability or higher (PR:L) to submit the shortcode. Exploitation is further gated on the plugin's legacy shortcode path being active: the 'ctf_statuses' 'support_legacy_shortcode' option must be boolean true, which the description states occurs by default when the admin has configured access tokens with zero or multiple legacy feeds. The specific injection vector is the 'buttoncolor' attribute of the Custom Twitter Feeds legacy shortcode, which lacks input sanitization and output escaping. Payload execution requires a victim (any user, including an admin) to subsequently view the page containing the injected shortcode. Sites on 2.8.0 or earlier without the legacy shortcode option enabled are not exposed via this path. |
| Impact | This is a moderate-severity authenticated stored XSS. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) is internally consistent with the description: network-reachable, low complexity, requiring low privileges (contributor-level WordPress account), no user interaction to inject, scope-changed (script executes in other users' browser contexts), with limited confidentiality and integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided - this is not confirmed to be actively exploited and no exploit code is identified at time of analysis. SSVC-style reading: exploitation is 'none observed', automatable is 'no' (requires an authenticated contributor account and a specific plugin configuration state), technical impact is 'partial'. Net: a real but not urgent issue - patch in normal cycles. The key risk-limiting nuance not captured by the raw score is the exploitation gate: the vulnerable legacy shortcode path is only active when 'support_legacy_shortcode' is true, which the description says happens by default only when the admin has configured access tokens with zero or multiple legacy feeds. Prioritization should weigh this configuration dependency plus the trust already implied by contributor access. |
| Exploit ScenarioDerived | An attacker who holds (or phishes/registers into) a contributor-level account on a WordPress site running Custom Twitter Feeds <=2.8.0, on an install where legacy shortcode support is active, embeds a Twitter/X feed shortcode with a malicious 'buttoncolor' attribute containing JavaScript. Because the legacy attribute is neither sanitized on input nor escaped on output, the payload is stored and then executes in the browser of any user - including higher-privileged editors or admins - who views the injected page. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Authenticated stored cross-site scripting in the Custom Twitter Feeds (A Tweets Widget or X Feed Widget) WordPress plugin affects all versions up to and including 2.8.0, allowing an attacker holding a contributor-level account or higher to embed arbitrary script in the 'buttoncolor' attribute of the plugin's legacy shortcode. The injected markup is stored and executes in the browser of any user - including an administrator - who later views the affected page, with the cross-boundary scope (S:C) reflecting that the payload runs in the context of the hosting site rather than the plugin itself. Exploitation is conditional: the legacy code path must actually be active, and per the vendor analysis this occurs by default on common installs where the admin configured access tokens together with zero or multiple legacy feeds, which sets the ctf_statuses 'support_legacy_shortcode' option to boolean true. At time of analysis there was no public exploit identified and the issue is not recorded as confirmed actively exploited (CISA KEV), so the practical risk is a post-authentication content-injection scenario rather than an unauthenticated remote compromise.
RemediationAI
The authoritative fix is an updated Custom Twitter Feeds release from the plugin vendor; the WordPress.org changeset reference in the advisory (https://plugins.trac.wordpress.org/changeset?reponame=&new=3695675%40custom-twitter-feeds&old=3665650%40custom-twitter-feeds) shows upstream code changes following the 2.8.0 tag, but a specific patched version number is not established by the available data, so upstream fix availability should be treated as "upstream fix available (PR/commit); released patched version not independently confirmed" - administrators should verify the current plugin version in the WordPress dashboard and upgrade to the latest release, then confirm the fix against the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9d042-c0c0-477a-8cdf-9fb9d2239059?source=cve. Where immediate upgrading is not possible, the highest-value compensating control is to deactivate the vulnerable legacy code path: ensure the plugin option ctf_statuses / support_legacy_shortcode is set to false (and avoid configuring access tokens in the combination - zero or multiple legacy feeds - that the vendor says forces this option to true), accepting that any existing pages using legacy shortcode attributes may render differently or lose styling. Because exploitation requires a contributor-level account, a second effective control is to review and reduce authoring privileges - remove contributor or higher roles from untrusted users, or install a role-management plugin to strip the unfiltered_html-equivalent capability - at the cost of restricting editorial workflows on multi-author sites. Additional hardening with minimal functional trade-off includes deploying a web application firewall rule that rejects shortcode attributes containing HTML or event handlers (may cause false positives on legitimate color values), auditing existing posts for injected shortcodes before the fix is applied, and monitoring for unexpected content changes by low-privileged authors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / cross-site scripting) in the shortcode-handling code of the Custom Twitter Feeds plugin. WordPress shortcodes are processed server-side by registering a callback that parses attributes supplied by post authors; the vulnerability here is that the 'buttoncolor' attribute is passed through without input sanitization and its value is emitted into the rendered feed markup without output escaping. The vulnerable flow spans several plugin files referenced by the vendor - the shortcode/feed rendering code in inc/CtfFeed.php (notably around the feed construction and attribute handling lines), the parser in inc/CTF_Parse.php, the settings handling in inc/CTF_Settings.php (which controls the ctf_statuses / support_legacy_shortcode option), and the plugin bootstrap custom-twitter-feed.php. The critical nuance is the conditional legacy path: the plugin maintains both a modern and a legacy shortcode implementation, and only when support_legacy_shortcode is boolean true does rendering route through the unfiltered legacy attribute code. Per the vendor description, that option is set to boolean true by default on installs where the administrator has configured access tokens with zero or multiple legacy feeds - meaning many real-world configurations are exposed even though the vulnerable branch is not universally active. The CPE entry (cpe:2.3:a:smub:custom_twitter_feeds_-_a_tweets_widget_or_x_feed_widget) covers the whole plugin product line with an unconstrained version field, consistent with the vendor statement that every version up to and including 2.8.0 is affected. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity attack that requires low privileges (an authenticated contributor), with no user-interaction precondition counted in the score even though payload execution in practice depends on a victim viewing the injected page; scope is changed and the confidentiality and integrity impacts are low, with no availability impact.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-injectable by a contributor (PR:L), no interaction to store the payload, stored XSS executing in other users' browsers is a scope change (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Custom Twitter Feeds - A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB