The vulnerability occurs when the Inline Tweets plugin does not properly escape user‑supplied tweet content before rendering it in a WordPress page, allowing malicious script code to be stored in the tweet text and executed in the browsers of visitors who view the tweet. This stored cross‑site scripting flaw can lead to arbitrary JavaScript running client‑side for any site visitor that accesses the affected tweet.

The flaw affects installations of mdjekic Inline Tweets for WordPress with a version of 2.0 or earlier. The plugin is packaged as a WordPress plugin and can be downloaded and installed from the WordPress Plugin Directory under the name Inline Tweets.

The CVSS score of 7.1 marks the issue as a high‑severity problem, while an EPSS score of less than 1% suggests that exploitation is unlikely but still possible. It is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is the plugin’s tweet submission interface, where an attacker could supply crafted tweet content that is stored and later rendered in the page for all visitors, resulting in client‑side script execution.