CVE-2026-7509

Vulnerability

The KIA Subtitle plugin for WordPress, in all versions up to and including 4.0.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the the-subtitle shortcode [1][3]. The before and after attributes are not properly sanitized or escaped, allowing malicious input to be stored and executed in the context of a viewer's browser.

Exploitation

An authenticated attacker with at least Contributor-level access can inject arbitrary JavaScript into the before or after attributes of the the-subtitle shortcode when creating or editing a post or page. When any user visits that page, the injected script executes in their browser.

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts in the victim's browser, potentially leading to session cookie theft, redirection to malicious sites, or defacement. The attack affects all users who view the compromised page.

Mitigation

The vulnerability is fixed in version 4.0.2 [2][4]. Users are strongly advised to update to this version immediately. No other workarounds are documented.