The Arrow Custom Feed for Twitter plugin by Arrow Plugins suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw affects all versions up to 1.5.3 and could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser when viewing the affected feed, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability requires low attack complexity and privileges but does require user interaction. The scope is changed, meaning the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting plugin usage or applying web application firewall rules to detect and block malicious input patterns related to this vulnerability.