Junglewise Threat Intelligence

CVE-2026-6177: Smash Balloon Custom Twitter Feeds Stored XSS in get_post_text

CVE-2026-6177 · Severity: high · CVSS 7.2 · Published 2026-05-13

Executive brief

The Custom Twitter Feeds plugin for WordPress, which displays Twitter content on websites, contains a security flaw that allows attackers to inject malicious scripts. By posting a specific tweet that the plugin then caches and displays, an attacker can execute code in the browsers of site visitors. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technical details

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function. The vulnerability is exposed via the ctf_get_more_posts AJAX action, which is available to unauthenticated users and outputs cached tweet data using nl2br() without proper HTML escaping. An attacker can exploit this by getting malicious content into the cached tweet data—either by tweeting content that matches the site's feed configuration or through other injection vectors. When the unauthenticated AJAX endpoint is accessed, the malicious script is executed in the context of the victim's browser. A patch is available in versions following 2.5.4.

Affected products

  • Smash Balloon Custom Twitter Feeds up to and including 2.5.4

Timeline

  • 2026-05-13: disclosed
  • 2026-05-13: advisory

References