CVE-2025-7655: 
WordPress vulnerability analysis and mitigation

The Live Stream Badger plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.4.3. The vulnerability exists in the plugin's 'livestream' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The issue was discovered and disclosed on July 18, 2025 (NVD).

The vulnerability stems from improper input validation and output escaping in the plugin's shortcode handling functionality. The affected component is the 'livestream' shortcode which processes user-supplied attributes without proper sanitization. This vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to theft of sensitive information or manipulation of page content (NVD).

Users should update to a version newer than 1.4.3 once available. Until then, it is recommended to restrict access to the WordPress editor to trusted users only and carefully monitor any content containing the 'livestream' shortcode (NVD).