The Twentig plugin for WordPress incorrectly handles the value entered into the featuredImageSizeWidth field, storing it without proper sanitization or escaping. When an authenticated user with Contributor-level privileges records a value, the data is later rendered on pages, allowing a stored cross‑site scripting flaw that can execute arbitrary JavaScript code in the browsers of visitors to the affected page.

This vulnerability affects the Twentig Supercharged Block Editor – Blocks, Patterns, Starter Sites, Portfolio WordPress plugin for the vendor Twentig. All releases up to and including version 1.9.7 are impacted; any site running those versions is vulnerable unless the plugin is upgraded to a newer release that removes the flaw.

The CVSS score of 6.4 classifies it as a medium‑severity issue. Exploitation requires an authenticated account with Contributor or higher privileges. Because the payload is stored, it will run whenever a user views the compromised page, potentially exposing the site to broader attacks; typical consequences of stored XSS include credential theft, session hijacking, or defacement, though these are inferred from the nature of the flaw and are not explicitly stated in the CVE description. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog.