CVE-2026-84909: Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctfstatuses supportlegacyshortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugins/custom-twitter-feedsto a version that resolves this vulnerability.Fixed in 2.8.0 - Configuration
Disable legacy shortcode processing by setting the option ctf_statuses support_legacy_shortcode to boolean false to avoid the unfiltered legacy shortcode attribute code path.
Custom Twitter Feeds – A Tweets Widget or X Feed Widget (legacy shortcode handling) ctf_statuses support_legacy_shortcode = false
Event History
Frequently Asked Questions
Which sites are exposed to the vulnerable shortcode path?
Common installations are affected when an administrator has configured access tokens and the site has zero or multiple legacy feeds. In that situation, the ctf_statuses support_legacy_shortcode option is set to true by default, enabling the unfiltered legacy shortcode attribute path.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They can inject script through the buttoncolor shortcode attribute into a page, where it executes when another user visits that page.
What is the likely impact after exploitation?
The injected JavaScript runs in the browser of users who access the affected page. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.