CVE-2026-84909 smub CVE debrief

Who should care

WordPress administrators, users with contributor-level access, and security teams responsible for monitoring and maintaining WordPress installations should assess exposure and prioritize verification of affected versions and remediation.

Why it matters

CVE-2026-84909 is a Stored Cross-Site Scripting vulnerability in the Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress. It allows authenticated attackers with contributor-level access to inject arbitrary web scripts, potentially leading to unauthorized actions or data exposure. WordPress administrators and users with contributor-level access should assess exposure and prioritize verification of affected versions and remediation.

• Attackers may inject arbitrary web scripts, potentially leading to unauthorized actions or data exposure.
• The vulnerability requires authenticated access with contributor-level permissions, reducing the attack surface but still posing a risk.
• Successful exploitation could result in malicious scripts executing on user-accessed pages, impacting site integrity and user trust.
• Verification of affected versions and remediation is crucial to prevent potential exploitation.

Technical summary

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts will execute when a user accesses an injected page. The vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, causing the ctf_statuses support_legacy_shortcode option to be set to boolean true by default and activating the unfiltered legacy

Defensive priority

WordPress administrators and users with contributor-level access should assess exposure and prioritize verification of affected versions and remediation.

Recommended defensive actions

• Verify the version of the Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin and update to a patched version if necessary.
• Restrict access to the plugin's settings and shortcode attributes to prevent unauthorized modifications.
• Implement additional security measures, such as input validation and output escaping, to prevent similar vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. Evidence is limited to N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.