PT-2026-40602 · WordPress · Custom Twitter Feeds

Gidget Smith · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-6177

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Twitter Feeds versions prior to 2.5.5

Description The Custom Twitter Feeds plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the CTF Display Elements::get post text() function fails to properly escape output when rendering cached tweet text. Specifically, the 'ctf get more posts' AJAX action is accessible to unauthenticated users and outputs cached tweet data using nl2br() without HTML escaping. An attacker can inject malicious HTML or JavaScript into the cached tweet data, which then executes when an unauthenticated user accesses the affected endpoint.

Recommendations Update the plugin to a version later than 2.5.4. As a temporary workaround, restrict access to the 'ctf get more posts' AJAX action to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6177

Affected Products

Custom Twitter Feeds

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-6177 · Security Note
• https://t.me/CVEtracker/53653 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3519584%40custom-twitter-feeds&old=3481416%40custom-twitter-feeds · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php#L505 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/templates/item.php#L36 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php#L521 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/templates/item.php#L36 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php#L505 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php#L521 · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L447 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e4b2178f-e4da-4bfb-9c27-8c1884499769?source=cve · Note
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/custom-twitter-feed.php#L447 · Note