# CVE-2026-6177: Smash Balloon Custom Twitter Feeds Stored XSS in get_post_text

Source: https://junglewise.ai/threats/cve-2026-6177-smash-balloon-custom-twitter-feeds-stored-xss-in-get-post-text  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6177 · Severity: high · CVSS 7.2 · Published 2026-05-13

The Custom Twitter Feeds plugin for WordPress, which displays Twitter content on websites, contains a security flaw that allows attackers to inject malicious scripts. By posting a specific tweet that the plugin then caches and displays, an attacker can execute code in the browsers of site visitors. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Vendors: [Smash Balloon](https://junglewise.ai/threats/vendors/smash-balloon).

## Quick answers

**Is CVE-2026-6177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6177 being exploited in the wild.

**How severe is CVE-2026-6177?** High severity, with a CVSS score of 7.2, published 13 May 2026.

**Which products and versions are affected?** Smash Balloon Custom Twitter Feeds up to and including 2.5.4.

**Is there a fix for CVE-2026-6177?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6177 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6177?** Check whether you run Smash Balloon Custom Twitter Feeds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function. The vulnerability is exposed via the ctf_get_more_posts AJAX action, which is available to unauthenticated users and outputs cached tweet data using nl2br() without proper HTML escaping. An attacker can exploit this by getting malicious content into the cached tweet data—either by tweeting content that matches the site's feed configuration or through other injection vectors. When the unauthenticated AJAX endpoint is accessed, the malicious script is executed in the context of the victim's browser. A patch is available in versions following 2.5.4.

## Affected products

- Smash Balloon Custom Twitter Feeds up to and including 2.5.4

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory

## References

- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/custom-twitter-feed.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/custom-twitter-feed.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/templates/item.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/templates/item.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php)
- [https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php](https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php)