CVE-2026-1911 is a stored cross-site scripting vulnerability in the Twitter Feeds WordPress plugin by viaviwebtech. The flaw exists in the handling of the 'tweet_title' parameter within the 'TwitterFeeds' shortcode, where insufficient input sanitization and output escaping allow authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts persist and execute in the context of any user viewing the injected page. The vulnerability affects all versions up to and including 1.0.0. The CVSS 3.1 score is 6.4 (medium), with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising user confidentiality and integrity of the site content. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the Twitter Feeds plugin if possible. Monitor for updates from viaviwebtech regarding patches or official mitigations.