{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11860", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-16T13:26:59.906Z", "datePublished": "2025-11-11T03:30:49.264Z", "dateUpdated": "2026-04-08T17:24:20.040Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:20.040Z"}, "affected": [{"vendor": "caselock", "product": "Twitter Feed", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce182e57-a9d4-4c4b-b124-e6626ccdd712?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ot-twitter-feed/trunk/ottwitterfeed-shortcode.php#L27"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-11-10T15:17:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:21:00.152639Z", "id": "CVE-2025-11860", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:30:18.210Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T15:21:00.152639Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:21:00.901Z"}}], "cna": {"title": "Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "caselock", "product": "Twitter Feed", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:17:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce182e57-a9d4-4c4b-b124-e6626ccdd712?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ot-twitter-feed/trunk/ottwitterfeed-shortcode.php#L27"}], "descriptions": [{"lang": "en", "value": "The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:20.040Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11860", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:20.040Z", "dateReserved": "2025-10-16T13:26:59.906Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:49.264Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11860", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-11T04:15:43.270", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ot-twitter-feed/trunk/ottwitterfeed-shortcode.php#L27"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce182e57-a9d4-4c4b-b124-e6626ccdd712?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:43:39.553092+00:00", "value": {"mitigation_remediation": ["Update the Twitter Feed plugin to the latest available version (>=1.3.2) issued by caselock.", "If an update is not immediately possible, disable or remove the ottwitter_feed shortcode from the site to eliminate the vector.", "Restrict or review contributor\u2011level accounts, and consider requiring two\u2011factor authentication for all authenticated users to reduce the risk of malicious script injection."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting for users with Contributor level access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the \"Twitter Feed\" plugin developed by caselock, in all versions up to and including 1.3.1. No other products or versions are listed as affected.", "description_and_impact": "The Twitter Feed plugin for WordPress stores unfiltered data in the width and height shortcode parameters, enabling a contributor or higher to inject JavaScript that is executed when any visitor loads a page containing the affected shortcode. This stored Cross\u2011Site Scripting flaw allows arbitrary script execution, which can be used to deface content, steal session cookies, or redirect users, compromising the integrity and confidentiality of the site.", "risk_and_exploitability": "With a CVSS score of 6.4, the issue is considered moderate in severity. The EPSS score of less than 1% indicates that current exploitation attempts are very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have contributor\u2011level or higher access to the WordPress site, after which the stored XSS payload can impact any visitor of a page that includes the impacted shortcode. Even though the attack vector requires authentication, the potential damage to the site\u2019s user experience and data integrity warrants prompt attention."}}}}, "created": "2025-11-12T12:42:55.859275+00:00", "updated": "2026-04-21T01:45:24.449475+00:00", "vendors": ["caselock", "caselock$PRODUCT$twitter_feed", "wordpress", "wordpress$PRODUCT$wordpress"]}