{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1911", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T15:32:17.395Z", "datePublished": "2026-03-21T03:27:02.952Z", "dateUpdated": "2026-04-08T17:23:29.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:29.587Z"}, "affected": [{"vendor": "viaviwebtech", "product": "Twitter Feeds", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb725044-01c3-4c0c-b276-291f897f11e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/trunk/twitter-feeds.php#L490"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/tags/1.0.0/twitter-feeds.php#L490"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-03-20T15:08:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:31:21.821318Z", "id": "CVE-2026-1911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:31:30.553Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:31:21.821318Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:31:27.096Z"}}], "cna": {"title": "Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "viaviwebtech", "product": "Twitter Feeds", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:08:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb725044-01c3-4c0c-b276-291f897f11e7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/trunk/twitter-feeds.php#L490"}, {"url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/tags/1.0.0/twitter-feeds.php#L490"}], "descriptions": [{"lang": "en", "value": "The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:29.587Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1911", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:23:29.587Z", "dateReserved": "2026-02-04T15:32:17.395Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:02.952Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Twitter Feeds para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'tweet_title' en el shortcode 'TwitterFeeds' en todas las versiones hasta la 1.0.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1911", "lastModified": "2026-04-22T21:32:08.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:16:56.433", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/tags/1.0.0/twitter-feeds.php#L490"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/twitter-feeds/trunk/twitter-feeds.php#L490"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb725044-01c3-4c0c-b276-291f897f11e7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Twitter Feeds", "source": "cna", "vendor": "viaviwebtech"}, "product": "twitter_feeds", "vendor": "viaviwebtech"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:38:21.220251+00:00", "value": {"mitigation_remediation": ["Upgrade the Twitter Feeds plugin to a version that no longer processes the 'tweet_title' shortcode without sanitization.", "If no upgrade is available, restrict the Contributor role or higher from using the shortcode that includes the 'tweet_title' parameter.", "Implement content filtering or a sanitized wrapper for the 'tweet_title' attribute through a custom plugin or code snippet.", "Add a Content Security Policy that blocks inline scripts to mitigate potential execution of injected code."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting via a shortcode parameter allowing authenticated contributors to inject arbitrary scripts"}, "threat_synthesis": {"affected_systems": "The vulnerability is confined to the viaviwebtech Twitter Feeds plugin for WordPress, impacting all releases through version 1.0.0. Sites running any of these affected versions may permit contributors to embed harmful content.", "description_and_impact": "Stored XSS in the Twitter Feeds WordPress plugin arises from unsanitized consumption of the 'tweet_title' attribute within its shortcode. Attackers with Contributor or higher permissions can embed malicious scripts that are rendered when other users view the affected page, enabling unauthorized code execution. The flaw aligns with CWE\u201179 and compromises client\u2011side confidentiality and integrity by executing attacker\u2011controlled code in users\u2019 browsers.", "risk_and_exploitability": "The CVSS base score of 6.4 reflects moderate severity, while the EPSS score is unavailable, leaving the exact exploitation likelihood uncertain. The flaw is not yet known to be actively exploited and is absent from the CISA KEV list. Successful exploitation requires an authenticated Contributor\u2011level account and the use of the vulnerable 'tweet_title' attribute. Once activated, the injected script executes in the context of arbitrary visitors accessing the contaminated page."}}}}, "created": "2026-03-23T09:50:01.204362+00:00", "updated": "2026-03-25T14:41:41.584852+00:00", "vendors": ["viaviwebtech", "viaviwebtech$PRODUCT$twitter_feeds", "wordpress", "wordpress$PRODUCT$wordpress"]}