The WP Twitter Auto Publish plugin allows an unauthenticated attacker to inject arbitrary JavaScript through the PostMessage interface because it fails to properly sanitize or escape user‑supplied data. An attacker who lures a visitor to a crafted link could have the victim’s browser execute malicious code in the context of the site, potentially accessing site information, stealing credentials, or defacing content. This vulnerability is a classic reflected XSS flaw categorized as CWE‑79.

The flaw affects all installations of the WP Twitter Auto Publish WordPress plugin with versions 1.7.4 and earlier. The product is provided by f1logic and user sites should verify that they are using a newer, patched version.

The CVSS score of 6.1 indicates a moderate severity with impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is valid through any guest‑visible page that triggers the PostMessage endpoint; an attacker only needs to entice a user to click a crafted link to succeed.