The WordPress plugin tli.tl auto Twitter poster contains an improper neutralization of user input that allows an attacker to store malicious scripts within the plugin’s data. When the stored data is subsequently rendered on a web page, the script executes in the browsers of other site visitors, potentially enabling phishing, session hijacking, or defacement. This vulnerability was identified as a Cross‑Site Scripting flaw, designated by CWE‑79.

The issue affects the tli.tl auto Twitter poster plugin by khashabawy, across all releases up to and including version 3.4. Any WordPress site that hosts a vulnerable version of this plugin is potentially exposed.

With a CVSS score of 5.9 the vulnerability is of moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no known large‑scale attacks. Based on the description, it is inferred that exploitation normally requires an attacker to supply malicious input through the plugin’s interface, which is then stored and later rendered to other users – the most likely attack vector is remote via the web interface.