Stored Cross-Site Scripting Vulnerability in Twittee Text Tweet Plugin for WordPress

CVE-2026-4089

What is CVE-2026-4089?

The Twittee Text Tweet plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access and above to exploit stored cross-site scripting (XSS) through the 'id' shortcode attribute. This flaw arises from inadequate input sanitization and output escaping, allowing attackers to inject malicious web scripts via the $id parameter into HTML attributes. The affected function utilizes extract() to transform shortcode attributes into local variables, then inserts them directly into HTML output without proper escaping. This oversight also affects $tweet, $content, $balloon, and $theme attributes, enabling potential execution of harmful scripts upon page access.

References