Stored XSS in the Twitter Feeds WordPress plugin arises from unsanitized consumption of the 'tweet_title' attribute within its shortcode. Attackers with Contributor or higher permissions can embed malicious scripts that are rendered when other users view the affected page, enabling unauthorized code execution. The flaw aligns with CWE‑79 and compromises client‑side confidentiality and integrity by executing attacker‑controlled code in users’ browsers.

The vulnerability is confined to the viaviwebtech Twitter Feeds plugin for WordPress, impacting all releases through version 1.0.0. Sites running any of these affected versions may permit contributors to embed harmful content.

The CVSS base score of 6.4 reflects moderate severity, while the EPSS score is unavailable, leaving the exact exploitation likelihood uncertain. The flaw is not yet known to be actively exploited and is absent from the CISA KEV list. Successful exploitation requires an authenticated Contributor‑level account and the use of the vulnerable 'tweet_title' attribute. Once activated, the injected script executes in the context of arbitrary visitors accessing the contaminated page.