CVE-2025-7809: StreamWeasels Twitch Integration XSS Flaw

CVE-2025-7809 Overview

CVE-2025-7809 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the StreamWeasels Twitch Integration plugin for WordPress. The flaw affects all plugin versions up to and including 1.9.3. It stems from insufficient input sanitization and output escaping on the plugin's data-uuid attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, enabling session theft, redirection, and content manipulation within the WordPress site context.

Critical Impact
Authenticated contributors can persist malicious JavaScript into published pages, enabling execution in the browsers of site visitors and administrators.

Affected Products

StreamWeasels Twitch Integration plugin for WordPress — all versions ≤ 1.9.3
WordPress sites allowing contributor-level or higher user registration
Any WordPress deployment using the vulnerable plugin's shortcode or block output

Discovery Timeline

2025-07-29 - CVE-2025-7809 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7809

Vulnerability Analysis

The plugin accepts user-supplied values that are rendered into the data-uuid HTML attribute without adequate sanitization or output escaping. A contributor-level account can submit crafted attribute content through plugin shortcodes or block parameters. When WordPress renders the containing page, the attacker-controlled payload is written directly into the DOM. Any script that executes from that attribute runs with the privileges of the viewer's session, including administrators.

Stored XSS in a WordPress plugin is particularly impactful because the payload persists in the database. Each page view triggers execution, which attackers use for session hijacking, forced administrative actions, cryptomining injection, or pivoting into the WordPress REST API with the viewer's credentials.

Root Cause

The root cause is missing sanitization on input and missing escaping on output for the data-uuid attribute. WordPress provides functions such as esc_attr() and sanitize_text_field() for this exact scenario. The vulnerable code paths referenced in streamweasels-public.js and the plugin's PHP rendering logic did not apply these controls before writing attribute values into HTML.

Attack Vector

Exploitation requires an authenticated account with at least contributor privileges. The attacker inserts a crafted plugin block or shortcode containing a malicious payload within the data-uuid attribute. After the content is saved and viewed, the payload executes in the victim's browser under the site's origin. Review the upstream fix in WordPress Changeset #3335250 and the Wordfence Vulnerability Report for additional technical context.

// No verified exploit code is published. Refer to the
// Wordfence advisory and the WordPress changeset above
// for technical details on the vulnerable code path.

Detection Methods for CVE-2025-7809

Indicators of Compromise

WordPress post or page content containing data-uuid attribute values with <script>, javascript:, or event handler strings such as onerror= or onload=.
Unexpected outbound requests from authenticated administrator sessions to attacker-controlled domains shortly after viewing content.
New administrative users, modified user roles, or unexpected changes to plugin and theme files following contributor activity.

Detection Strategies

Query the wp_posts table for post content containing the data-uuid attribute combined with HTML tag or JavaScript scheme patterns.
Monitor WordPress audit logs for contributor accounts creating or editing content that uses StreamWeasels Twitch Integration shortcodes or blocks.
Inspect served HTML with a crawler to flag data-uuid attribute values containing non-UUID content.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that disallows inline scripts and report violations to a monitored endpoint.
Alert on new or modified WordPress administrator accounts and on changes to the wp_options table that persist JavaScript.
Review web server access logs for anomalous POST requests to /wp-admin/post.php and /wp-json/wp/v2/ endpoints from contributor accounts.

How to Mitigate CVE-2025-7809

Immediate Actions Required

Update StreamWeasels Twitch Integration to the version released in WordPress Changeset #3335250, which supersedes 1.9.3.
Audit existing posts and pages for malicious payloads in the data-uuid attribute and remove any injected scripts.
Review contributor and author accounts, remove unused accounts, and rotate credentials for any suspected compromise.

Patch Information

The maintainers addressed the issue in a plugin release following the fix committed in WordPress Changeset #3335250. Site administrators should update through the WordPress plugin manager to a version greater than 1.9.3. See the Wordfence Vulnerability Report for upstream fix verification.

Workarounds

Deactivate the StreamWeasels Twitch Integration plugin until the patched version is deployed.
Restrict user registration and limit the number of contributor-level accounts on the site.
Deploy a web application firewall (WAF) rule that blocks requests containing script tags or JavaScript event handlers in plugin shortcode parameters.

bash

# Update the plugin via WP-CLI
wp plugin update streamweasels-twitch-integration

# Verify installed version is greater than 1.9.3
wp plugin get streamweasels-twitch-integration --field=version

# If a patched version is unavailable, deactivate the plugin
wp plugin deactivate streamweasels-twitch-integration