The vulnerability allows authenticated users with Contributor level access or higher to inject arbitrary JavaScript into the status‑classic‑offline‑text field of the StreamWeasels Kick Integration plugin. Because the input is stored and later output without proper sanitization, the injected code will execute whenever a user opens the affected page. This can be leveraged for session hijacking, credential theft, or defacement, compromising both confidentiality and integrity of user data.

All WordPress installations that have the StreamWeasels Kick Integration plugin at any version up to and including 1.1.3 are affected. The plugin is commonly used as a WordPress add‑on to manage status messages, and the impacted field is part of the user‑visible status output.

The CVSS score of 6.4 indicates a medium severity risk, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The flaw is not currently listed in CISA’s KEV catalog. The likely attack vector is an authenticated contributor or higher user creating or editing a status message; the web‑script payload is stored and then served to all visitors who view that status. While the vector requires authentication, it allows the attacker to influence the client‑side behavior of other users, potentially leading to widespread script execution.