CVE-2025-7655

Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published Jul 19, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The Live Stream Badger plugin allows authenticated users with contributor‑level permissions or higher to insert arbitrary web scripts into the 'livestream' shortcode via unsanitized attributes. Those scripts are stored and will execute in the browsers of any site visitor who loads a page containing the injected shortcode. The exploit does not grant direct code execution on the server, but it can compromise the integrity of visited pages and potentially affect user session data or other client‑side resources as the attacker controls the injected script.

Affected Systems

WordPress installations that use the tkrivickas Live Stream Badger plugin version 1.4.3 or any earlier release are affected. All releases up to and including 1.4.3 contain the flaw.

Risk and Exploitability

The CVSS score of 6.4 classifies the issue as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not included in the CISA KEV catalog. Attackers must be authenticated and possess at least contributor-level privileges to insert malicious attributes, after which the injected scripts run in any user’s browser that views the affected page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

tkrivickas

Live Stream Badger

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.4.3

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Live Stream Badger plugin to a version newer than 1.4.3, which contains the required input sanitization fix.
Scan all content that uses the 'livestream' shortcode for embedded scripts that were not part of the original design and remove or neutralize them.
Restrict or remove contributor‑level users’ ability to add or edit the livestream shortcode, or apply stricter server‑side validation to prevent malicious attribute values.

Generated by OpenCVE AI on April 22, 2026 at 17:05 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-21946	The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.264% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.svn.wordpress.org/live-stream-badger/tags/1.4.3/shortcode/class-embedded-stream.php
https://plugins.svn.wordpress.org/live-stream-badger/tags/1.4.3/view/class-embedded-twitch-view.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/22a30301-f409-4c53-84d7-7799fb41c25b?source=cve

History

Jul 21, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 19, 2025 2:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Weaknesses		CWE-79
References		https://plugins.svn.wordpress.org/live-stream-badger/tags/1.4.3/shortcode/class-embedded-stream.php https://plugins.svn.wordpress.org/live-stream-badger/tags/1.4.3/view/class-embedded-twitch-view.php https://www.wordfence.com/threat-intel/vulnerabilities/id/22a30301-f409-4c53-84d7-7799fb41c25b?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`