CVE-2025-58790

The Kiwi Social Share plugin for WordPress versions up to 2.1.8 contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code that will be stored on the server and executed when other users visit the affected page.

Exploitation requires the attacker to have at least a contributor-level account on the WordPress site. The attacker can inject malicious payloads through the plugin's settings or share button configurations. No additional user interaction is required for the stored XSS to execute, though the initial injection is performed by a privileged user [1].

Successful exploitation can lead to a variety of impacts, including redirecting visitors to malicious sites, displaying unauthorized advertisements, stealing cookies or session tokens, and defacing the website. The CVSS v3 score is 6.5 (Medium) [1].

As a mitigation, users are strongly advised to update the Kiwi plugin to the latest available version. If an update is not available, it is recommended to contact the hosting provider or a web developer for assistance [1].