Security Alert Summary
The Twentig plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the featuredImageSizeWidth parameter. Authenticated users with Contributor-level access or higher can inject scripts that will execute whenever an affected page is loaded, due to insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-2602
- Affected component: Twentig plugin for WordPress
- Affected versions: versions up to, and including, 1.9.7
- Published: March 29, 2026 at 2:16:16 AM UTC
- Last Modified: March 29, 2026 at 2:16:16 AM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW (authenticated users with Contributor-level access or higher)
- User Interaction: NONE
- Scope: CHANGED
- Primary impact:
- Confidentiality: LOW
- Integrity: LOW
- Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting issue that arises from insufficient input sanitization and missing output escaping for the featuredImageSizeWidth parameter. An authenticated user who can set or submit this parameter (Contributor-level access and above, per the description) can inject HTML or JavaScript that is persisted and later rendered in pages viewed by other users.
Because the injected content is stored, the malicious script executes whenever an affected page is accessed by users with access to that page. The description does not name specific functions or REST endpoints beyond the parameter, so mitigation and review should focus on places where featuredImageSizeWidth values are accepted, stored, and rendered.
The practical impact is the ability to run arbitrary script in the context of affected pages, which can be used to modify displayed content or capture data available in the user’s browser session. The CVSS metrics indicate limited confidentiality and integrity impact and no availability impact.
How This Could Impact Your Website
Consider a site with a site owner, several internal staff members (editors), and external contributors. A contributor who can edit or submit content that includes the featuredImageSizeWidth parameter could store a script that runs when an editor or site owner views the affected page. That script could alter page content seen by those users or attempt to collect information visible to them.
Realistic consequences include exposure of information available in the browser (such as profile details displayed on the page), modification of page content that could mislead staff, and an increased risk of targeted phishing or social engineering if attackers gather email addresses or other contact details. The vulnerability does not imply full site takeover based on the provided data, but it does increase risk to user-facing content and data accessible in the browser context.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can submit content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit recent content for unexpected or suspicious changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
