The Simple Tweet plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-0700. This vulnerability allows authenticated users with author-level privileges or higher to inject arbitrary JavaScript code through the 'Tweet this text' input field. The injected scripts persist and execute in the context of users visiting the compromised pages due to inadequate input sanitization and output escaping in all plugin versions up to 1.4.0.2. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation allows an authenticated user with author-level access or higher to inject persistent malicious scripts into pages generated by the Simple Tweet plugin. This can lead to unauthorized actions performed in the context of other users viewing the injected content, potentially compromising user confidentiality and integrity. The vulnerability does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or removing the Simple Tweet plugin if possible. Monitor for updates from the vendor or WordPress plugin repository for a security patch addressing this issue.