Stored Cross-Site Scripting in kk Youtube Video Plugin for WordPress

CVE-2025-6061

What is CVE-2025-6061?

The kk Youtube Video plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied attributes in the 'kkytv' shortcode. This vulnerability can be exploited by authenticated users with contributor-level access or higher, enabling them to inject arbitrary web scripts into pages. These scripts would execute whenever a user accesses an affected page, posing significant security risks.

References