The Twitscription plugin for WordPress is vulnerable to reflected cross‑site scripting because the PATH_INFO supplied to admin.php is not properly sanitized or escaped. An attacker can craft a malicious URL that, when clicked by an unsuspecting user, injects arbitrary JavaScript into the response. This flaw falls under CWE‑79 and can be used to hijack a user session, deface a page, or perform other client‑side attacks.

All installations of the Twitscription plugin through version 0.1.1 are affected. The plugin is distributed by the vendor natambu and is used within the WordPress ecosystem.

The CVSS score of 6.1 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely to involve an unauthenticated user clicking a malicious link that contains a crafted PATH_INFO, which triggers the injection when the admin.php page is accessed.