The Twittee Text Tweet plugin contains a stored XSS flaw caused by unsanitized shortcode attributes. When an attacker supplies a specially crafted value for the 'id' attribute, the plugin inserts it directly into an HTML id context and inline JavaScript without escaping, allowing the attacker to break out of the attribute and inject executable scripts that run for any user who views a page containing the shortcode. Only users with Contributor or higher privileges can create or edit the content that triggers the shortcode, so the vulnerability is limited to authenticated authors, but the compromise scope extends to all visitors loading affected pages.

The vulnerability exists in the Twittee Text Tweet WordPress plugin developed by johnnie2u. All releases up to and including version 1.0.8 are affected; newer releases are not covered by this advisory. WordPress sites that have installed the plugin and grant contributor‑level access to write or edit posts containing the shortcode are at risk.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. EPSS data is not available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated with at least Contributor permissions, but once installed the malicious script executes automatically for any user who views the affected content, providing widespread impact while restricting initial access to authenticated contributors. The lack of a public exploit and moderate CVSS score suggest the risk is real but not immediately critical, yet the capability to impact all site visitors warrants prompt remediation.