The Twitter Feed plugin for WordPress stores unfiltered data in the width and height shortcode parameters, enabling a contributor or higher to inject JavaScript that is executed when any visitor loads a page containing the affected shortcode. This stored Cross‑Site Scripting flaw allows arbitrary script execution, which can be used to deface content, steal session cookies, or redirect users, compromising the integrity and confidentiality of the site.

The vulnerability affects the "Twitter Feed" plugin developed by caselock, in all versions up to and including 1.3.1. No other products or versions are listed as affected.

With a CVSS score of 6.4, the issue is considered moderate in severity. The EPSS score of less than 1% indicates that current exploitation attempts are very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have contributor‑level or higher access to the WordPress site, after which the stored XSS payload can impact any visitor of a page that includes the impacted shortcode. Even though the attack vector requires authentication, the potential damage to the site’s user experience and data integrity warrants prompt attention.