CVE-2025-6061: kk Youtube Video WordPress Plugin XSS Flaw

CVE-2025-6061 Overview

The kk Youtube Video plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in its kkytv shortcode. All versions up to and including 0.2 fail to properly sanitize input and escape output on user-supplied shortcode attributes. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, enabling session theft, redirection, or administrative account compromise when a privileged user visits the content.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes against site administrators and visitors, leading to potential account takeover.

Affected Products

kk Youtube Video plugin for WordPress — all versions through 0.2
WordPress sites permitting contributor-or-higher registrations
Multisite installations using the vulnerable plugin

Discovery Timeline

2025-06-14 - CVE-2025-6061 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6061

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the kkytv shortcode handler defined in kk-youtube-video.php. When a contributor or higher-privileged user inserts the shortcode into post or page content, the plugin renders the shortcode's attributes into HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). Attackers control attribute values directly, so any JavaScript payload placed inside a shortcode attribute is written to the DOM verbatim. Because contributor accounts can create draft content that reviewers and editors preview, the payload triggers in the browser of a higher-privileged reviewer. Once an administrator loads the injected page, the script runs with the administrator's session context.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes processed by the plugin's rendering function. WordPress provides shortcode_atts() for defaults but does not sanitize values; developers must escape data at output time. The kk Youtube Video plugin concatenates the raw attribute values into the returned HTML string.

Attack Vector

The attack requires an authenticated account with contributor privileges. The attacker submits a post containing the kkytv shortcode with a malicious attribute value. When the post is previewed by an editor or published and viewed by a site visitor, the browser parses and executes the injected script under the site's origin. Review the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2025-6061

Indicators of Compromise

Post or page content in wp_posts containing [kkytv] shortcodes with <script>, onerror=, onload=, or javascript: fragments in attribute values
Unexpected outbound requests from browsers loading pages that render the kkytv shortcode
New administrator accounts, plugin installations, or theme modifications following contributor logins

Detection Strategies

Query the WordPress database for posts containing the kkytv shortcode and inspect attribute values for HTML or JavaScript syntax
Monitor web server access logs for POST requests to /wp-admin/post.php from contributor accounts creating content that includes the shortcode
Deploy a web application firewall rule that flags shortcode attributes containing angle brackets, quotes, or event handler keywords

Monitoring Recommendations

Log and alert on privilege changes, plugin installations, and theme edits initiated shortly after contributor session activity
Track browser Content Security Policy (CSP) violation reports for inline script execution on pages rendering plugin shortcodes
Review the WordPress audit trail for content edits by contributor accounts that reference the kkytv shortcode

How to Mitigate CVE-2025-6061

Immediate Actions Required

Deactivate and remove the kk Youtube Video plugin until a patched release is available
Audit existing post and page content for [kkytv] shortcodes and remove or sanitize any suspicious attribute values
Review contributor and author accounts, rotating credentials for any account showing anomalous content submissions

Patch Information

No fixed version has been published at the time of the NVD entry. All versions up to and including 0.2 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for updates.

Workarounds

Restrict contributor-or-higher registration and require manual account approval
Apply a web application firewall rule that strips HTML from kkytv shortcode attributes before rendering
Enforce a strict Content Security Policy that disallows inline scripts on pages generated by the plugin
Remove the shortcode registration by unloading the plugin file from wp-content/plugins/kk-youtube-video/

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate kk-youtube-video
wp plugin delete kk-youtube-video

# Search database for injected shortcodes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[kkytv%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"