Executive brief
Custom Twitter Feeds is a popular WordPress plugin that displays tweets and social media feeds on websites. The plugin fails to properly validate user input in shortcode attributes, allowing authenticated contributors to inject malicious scripts that execute when any visitor views the affected page. This can lead to account hijacking, credential theft, or malware distribution to website visitors.
Technical details
The plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the legacy shortcode attribute processing, specifically in the 'buttoncolor' parameter and related attributes, due to insufficient input sanitization and output escaping. The vulnerability affects all versions up to and including 2.8.0. Exploitation requires authenticated access with contributor-level privileges or higher; the legacy shortcode code path is automatically activated when the plugin has configured access tokens with zero or multiple legacy feeds. An attacker with these privileges can inject arbitrary JavaScript into page content via shortcode attributes, which then executes in the browsers of all users who visit the affected page. The injected scripts persist in the WordPress database, making this a stored (persistent) XSS vulnerability.
Affected products
- Automattic Custom Twitter Feeds up to and including 2.8.0
Timeline
- 2026-09-18: disclosed