smub Custom Twitter Feeds Plugin up to 2.5.4 on WordPress get_post_text cross site scripting

Summaryinfo

A vulnerability was found in smub Custom Twitter Feeds Plugin up to 2.5.4 on WordPress. It has been rated as problematic. Affected by this vulnerability is the function CTF_Display_Elements::get_post_text. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-6177. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in smub Custom Twitter Feeds Plugin up to 2.5.4 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function CTF_Display_Elements::get_post_text. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function when rendering cached tweet text. The plugin's ctf_get_more_posts AJAX action is available to unauthenticated users and directly outputs cached tweet data through nl2br() without HTML escaping. When an attacker can get malicious content into cached tweet data (either by tweeting content that gets cached by the site's feed configuration, or through other vulnerabilities), the malicious HTML/JavaScript is executed when the unauthenticated endpoint is accessed. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected endpoint.

The weakness was disclosed by Gidget Smith. The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-6177 since 04/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Social Network Software

Vendor

• smub

Name

• Custom Twitter Feeds Plugin

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion