The StreamWeasels Kick Integration plugin for WordPress includes a stored cross‑site scripting flaw that permits authenticated users with contributor or higher privileges to inject malicious JavaScript into the data‑uuid attribute. The plugin fails to sanitize or escape this attribute when rendering page content, so the injected script runs automatically in the browsers of any visitor who views the affected page. This allows the attacker to execute arbitrary client‑side code, potentially defacing content, phishing users, or delivering further payloads.

All releases of the StreamWeasels Kick Integration plugin up to and including version 1.1.4 are affected. Sites that employ these versions and have users with contributor or higher roles are vulnerable until the issue is addressed.

The weakness has a CVSS score of 5.4, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. An attacker must first authenticate as a contributor or higher, then use the plugin’s interface to persist the malicious script; once stored, the payload executes for all subsequent page viewers.