Stored Cross-Site Scripting Vulnerability in Twitch Integration Plugin for WordPress

CVE-2024-9897

Summary

The StreamWeasels Twitch Integration plugin for WordPress exhibits a vulnerability that permits Stored Cross-Site Scripting (XSS) via its sw-twitch-embed shortcode. This flaw stems from inadequate input sanitization and output escaping for user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into any page that users access. When an affected page is visited, the malicious scripts execute, posing significant security risks to site visitors and potentially compromising their information.

References