CVE-2026-84909 is a stored cross-site scripting vulnerability in the Custom Twitter Feeds – A Tweets Widget or X Feed Widget WordPress plugin. It affects all versions up to 2.8.0. The flaw exists because the 'buttoncolor' shortcode attribute is not properly sanitized or escaped, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. The vulnerability is triggered when the plugin's legacy shortcode support is enabled by default due to specific admin configurations involving access tokens and legacy feeds. This causes the unfiltered legacy shortcode attribute code path to be active, enabling exploitation.

An attacker with contributor-level or higher access can inject malicious JavaScript code into pages via the vulnerable shortcode attribute. This code executes in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability does not require user interaction (no UI needed) and affects confidentiality and integrity but not availability. The CVSS score is 6.4 (medium severity).

No official patch or fix is indicated in the provided data. Users should check the vendor advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and avoid configurations that enable legacy shortcode support if possible. Monitor for plugin updates that address this vulnerability and apply them promptly once released.