Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.
Published: 2025-01-07
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Obaid Hossain jQuery TwentyTwenty plug‑in for WordPress contains an improper neutralization of user‑supplied input during web page generation. This flaw allows malicious scripts to be stored in the plugin’s content and subsequently served to visitors, enabling arbitrary code execution within the victim’s browser.

Affected Systems

Any WordPress installation that includes the Obaid Hossain jQuery TwentyTwenty plug‑in version 1.0 or earlier is affected.

Risk and Exploitability

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw is not listed in CISA KEV. An attacker would need to inject a malicious payload through the plug‑in’s input controls that is stored in the database and later rendered in a page viewed by users. Without remediation, affected sites could expose visitors to unintended script execution.

Generated by OpenCVE AI on May 2, 2026 at 06:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the jQuery TwentyTwenty plug‑in to a release newer than version 1.0 or remove the plug‑in entirely if it is not required.
  • Sanitize or encode input fields supplied by the plug‑in to strip or neutralize script tags before storage and rendering.
  • Deploy a web‑application firewall or server‑side filtering layer that blocks disallowed script tags in content submitted via the plug‑in.

Generated by OpenCVE AI on May 2, 2026 at 06:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-2824 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in One Plus Solution jQuery TwentyTwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through 1.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in One Plus Solution jQuery TwentyTwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through 1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Tue, 07 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jan 2025 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in One Plus Solution jQuery TwentyTwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through 1.0.
Title WordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-11T22:34:49.888Z

Reserved: 2025-01-07T10:23:17.401Z

Link: CVE-2025-22546

cve-icon Vulnrichment

Updated: 2025-01-07T16:39:37.862Z

cve-icon NVD

Status : Deferred

Published: 2025-01-07T16:15:50.300

Modified: 2026-06-17T08:48:10.007

Link: CVE-2025-22546

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T07:00:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')