The Custom Twitter Feeds plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the function CTF_Display_Elements::get_post_text() fails to properly escape cached tweet text output. The unauthenticated AJAX action ctf_get_more_posts outputs cached tweet data using nl2br() without HTML escaping, enabling attackers to inject arbitrary JavaScript by influencing cached tweet content. This results in script execution in the context of users accessing the endpoint.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in users' browsers when they access the vulnerable AJAX endpoint. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, consider disabling the affected AJAX endpoint or restricting access to trusted users if feasible.