CVE-2026-6177 is a stored cross-site scripting vulnerability in the Custom Twitter Feeds WordPress plugin by smub, affecting versions up to 2.5.4. The issue arises from the CTF_Display_Elements::get_post_text() function, which fails to properly escape cached tweet text output. The unauthenticated AJAX action ctf_get_more_posts directly outputs this cached data using nl2br() without HTML escaping. Attackers can inject malicious HTML/JavaScript by submitting crafted tweets that become cached, leading to script execution in users' browsers when the endpoint is accessed.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the affected site for any user accessing the vulnerable AJAX endpoint. This can lead to session hijacking, defacement, or other client-side attacks. The CVSS score is 7.2 (high severity), indicating significant impact on confidentiality and integrity but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX endpoint or implementing web application firewall rules to block malicious payloads targeting this endpoint. Monitor vendor channels for an official patch or update.