The vulnerability arises from inadequate output escaping in the CTF_Display_Elements::get_post_text() function, allowing malicious HTML or JavaScript to be stored in cached tweet text. When the unauthenticated ctf_get_more_posts AJAX action retrieves this cached content, the script runs in the context of the site, potentially enabling credential theft, defacement, or further attacks. This flaw is a conventional Stored XSS (CWE‑79) with the primary impact of compromising the confidentiality and integrity of site users and the authenticity of the site’s content.

The issue affects the WordPress plugin Custom Twitter Feeds – A Tweets Widget or X Feed Widget, authored by smub, in all released versions up to and including 2.5.4. Anyone running this plugin version list is susceptible even if WordPress itself is secure. Versions newer than 2.5.4 are presumed fixed.

The CVSS score of 7.2 classifies this flaw as High severity. No EPSS score is available, so the exploitation probability cannot be quantified precisely, but Stored XSS attacks are historically common. The vulnerability can be exploited by an unauthenticated attacker who can inject malicious content into cached tweet data—typically by tweeting crafted material that the plugin caches. Once injected, any visitor accessing the ctf_get_more_posts endpoint will execute the malicious script, potentially leading to information disclosure, session hijacking, or site compromise. The flaw is not listed in CISA KEV, indicating no confirmed widespread exploitation yet, but the attack vector is clear and requires minimal prerequisites.