Stored Cross-Site Scripting in Custom Twitter Feeds Plugin for WordPress
CVE-2026-84909

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Custom Twitter Feeds – A Tweets Widget Or X Feed Widget
Vendor
CVE Published:
18 September 2026

What is CVE-2026-84909?

The Custom Twitter Feeds plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'buttoncolor' shortcode attribute. This flaw allows authenticated users with contributor-level access and higher to embed malicious scripts into pages. Whenever a user accesses an affected page, the injected scripts execute, potentially compromising user data or session integrity. This risk is heightened in installations where administrators have set up zero or multiple legacy feeds, triggering the ctf_statuses support_legacy_shortcode option to default to true, thereby enabling the unfiltered legacy shortcode execution path.

Affected Version(s)

Custom Twitter Feeds – A Tweets Widget or X Feed Widget 0 <= 2.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/custom-twitter...
https://plugins.trac.wordpress.org/browser/custom-twitter...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.