The vulnerability is an improper neutralization of user input during web page generation, classified as Cross‑Site Scripting. When a crafted request reaches the Twitter News Feed plugin, the plugin reflects the malicious payload back into the response, enabling an attacker to inject arbitrary JavaScript into the victim’s browser. This can lead to data theft, session hijacking, or defacement of the site for users who view the affected page. The weakness is identified as CWE-79.

Keir Whitaker Twitter News Feed plugin, versions from the earliest release up to and including 1.1.1 are vulnerable.

The CVSS score of 7.1 indicates a high severity for this flaw. The EPSS score of less than 1% shows a very low probability that it is currently being actively exploited, and it is not listed in CISA’s KEV catalog. The likely attack vector is a reflected XSS scenario in which an attacker sends a specially crafted URL to an unsuspecting user; the user’s browser then executes the payload when the page is rendered.