CVE-2025-9442

Vulnerability

Overview

The StreamWeasels Kick Integration plugin for WordPress, up to version 1.1.5, contains a Stored Cross-Site Scripting (XSS) vulnerability in the ‘vodsChannel’ parameter. The flaw arises from insufficient input sanitization and output escaping, allowing malicious scripts to be stored and executed when a user accesses an affected page [1].

Exploitation

Prerequisites

An attacker must be authenticated with at least Contributor-level access to the WordPress site. The vulnerability is triggered via the plugin’s shortcode or block that processes the ‘vodsChannel’ parameter, which is not properly sanitized before being stored or rendered [1].

Impact

Successful exploitation enables the attacker to inject arbitrary web scripts (e.g., JavaScript) into pages. These scripts execute in the context of any user who visits the injected page, potentially leading to session hijacking, defacement, or theft of sensitive information [1].

Mitigation

The vendor has not released a patched version as of the publication date. Users are advised to restrict Contributor-level access or disable the plugin until an update is available [1].