Urgent: Unauthenticated Stored XSS in “Custom Twitter Feeds (Tweets Widget)” — What WordPress Site Owners Must Do Now

Date: 13 May 2026
CVE: CVE-2026-6177
Affected plugin: Custom Twitter Feeds (Tweets Widget / X Feed Widget) — versions <= 2.5.4
Patched in: 2.5.5
Severity: Medium (CVSS 7.1) — unauthenticated stored Cross-Site Scripting (XSS)

From a Hong Kong security expert perspective: this advisory is a concise, pragmatic playbook for site owners, developers and administrators who need to act now. The vulnerability is a stored (persistent) XSS that can be triggered without authentication. Stored XSS is dangerous because injected code can persist in the site and impact any visitor or administrator who views the affected content.

TL;DR — Immediate Actions

1. Update the Custom Twitter Feeds plugin to version 2.5.5 or later immediately. This is the single most important step.
2. If you cannot update immediately, disable the plugin or remove any active widgets/shortcodes that rely on it.
3. Scan your site for injected scripts and signs of compromise (detection guidance below).
4. Rotate administrator passwords, reset sessions, and force logout for all users with elevated privileges.
5. Apply WAF rules or server-level filtering for stored XSS payloads while you patch.
6. If you find evidence of compromise, follow the incident response checklist below and restore from a clean backup if necessary.

What is the vulnerability (in plain terms)?

Stored Cross-Site Scripting (XSS) happens when an attacker stores malicious script code on the target site (for example, in database fields, widget content, or saved feed content). When a page or admin view renders that content without proper escaping, the browser executes the script. Possible consequences include:

• Theft of session cookies or tokens (leading to account takeover).
• Redirection to malicious sites.
• Drive-by malware installs.
• Content manipulation (SEO spam, hidden links, fake notices).

This vulnerability (CVE-2026-6177) affects Custom Twitter Feeds plugin versions up to 2.5.4 and can be triggered by unauthenticated attackers who submit crafted input that the plugin stores and later renders.

How an attacker might exploit this

Typical exploitation path:

• An attacker crafts a malicious tweet or feed entry containing script tags or payloads and injects it into the plugin’s stored content.
• The plugin stores the payload without adequate sanitization.
• When the widget or feed is rendered on the site (front-end or admin preview), the browser runs the malicious script under the site’s origin.
• If an administrator views an infected page in wp-admin, the attacker can attempt cookie theft, create admin users, plant backdoors, or execute other privileged actions.

Because the vulnerability is unauthenticated, attackers can probe and attempt injection repeatedly until successful. Treat affected plugin versions as high priority.

Who should be most worried?

• Sites using Custom Twitter Feeds / Tweets Widget (≤ 2.5.4).
• Sites embedding plugin feed data on public pages or allowing admin previews of feeds.
• Sites with multiple users and elevated roles.
• High-traffic or reputation-sensitive sites (e-commerce, membership, finance, news).

Detection: How to check if you were targeted or infected

Perform non-destructive checks first. Always back up before modifying data and preserve evidence if you find injected code.

1. Search the database for script tags and suspicious patterns

Use WP-CLI or direct SQL (replace wp_ with your table prefix):

wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

wp user list

wp search-replace '

(%3C|<)\s*script\b|%3Cscript%3E|onerror\s*=|onload\s*=|javascript\s*:

location / {
  if ($query_string ~* "(%3C|<)\s*script") {
    return 403;
  }
}

# WP-CLI search for script tags
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%