Improper neutralization of input during web page generation has been discovered in the titodevera Awesome Twitter Feeds plugin, allowing reflected XSS. The flaw causes attacker‑supplied data to be echoed back unescaped in the browser, enabling arbitrary script execution. This aligns with CWE‑79.

WordPress installations that use the titodevera Awesome Twitter Feeds plugin, versions up to and including 1.0.

The CVSS score of 7.1 places this issue in the high severity range, while the EPSS value of <1% indicates a low current probability of exploitation. It is not listed in the CISA KEV catalog, suggesting no known active exploits. Based on the description, it is inferred that an attacker would need to craft a malicious payload that is reflected by the plugin and entice a user to visit a crafted URL or provide input, implying user interaction is required for exploitation. No special privileges or administrative access are required to exploit this vulnerability.