CVE-2026-6177

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function when rendering cached tweet text. The plugin's ctf_get_more_posts AJAX action is available to unauthenticated users and directly outputs cached tweet data through nl2br() without HTML escaping. When an attacker can get malicious content into cached tweet data (either by tweeting content that gets cached by the site's feed configuration, or through other vulnerabilities), the malicious HTML/JavaScript is executed when the unauthenticated endpoint is accessed. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected endpoint.

• CWE-79

• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/custom-twitter-feed.php#L447
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php#L505
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/inc/CTF_Display_Elements.php#L521
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/tags/2.5.4/templates/item.php#L36
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L447
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php#L505
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/inc/CTF_Display_Elements.php#L521
• https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/templates/item.php#L36
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3519584%40custom-twitter-feeds&old=3481416%40custom-twitter-feeds
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b2178f-e4da-4bfb-9c27-8c1884499769?source=cve

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61764NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61765NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61766NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61767NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61768NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61769NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61770NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61771NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61772NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61773NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61774NVIDIA Megatron Bridge contains a vulnerability where an att…7.8
• CVE-2026-61775NVIDIA Megatron Bridge contains a vulnerability where an att…7.8