CVE-2025-6061
BaseFortify
Publication date: 2025-06-14
Last updated on: 2025-06-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the kk Youtube Video plugin for WordPress, specifically in the 'kkytv' shortcode. The plugin does not properly sanitize or escape user-supplied attributes, such as the YouTube video ID, width, and height. As a result, an authenticated attacker with contributor-level access or higher can inject malicious scripts into pages. These scripts will execute whenever any user views the infected page, potentially compromising user data or site integrity. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access to inject arbitrary JavaScript into WordPress pages via the kk Youtube Video plugin shortcode. When other users visit these pages, the malicious scripts execute in their browsers, potentially leading to theft of cookies, session tokens, or other sensitive information, defacement of the website, or redirection to malicious sites. This compromises the security and trustworthiness of the affected website. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for usage of the '[kkytv]' shortcode in WordPress posts or pages and inspecting the attributes for malicious scripts. Additionally, monitoring HTTP traffic for suspicious iframe URLs embedding YouTube videos with unusual parameters may help. Specific commands are not provided in the resources, but you can use WordPress CLI commands such as `wp post list --post_type=post --format=ids` combined with `wp post get <ID> --field=post_content` to search for the shortcode usage. Network traffic inspection tools like `tcpdump` or `Wireshark` can be used to monitor iframe embed requests to 'www.youtube.com/embed/'. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting contributor-level users from adding or editing posts with the '[kkytv]' shortcode until a patch is applied, removing or disabling the kk Youtube Video plugin version 0.2 or earlier, and sanitizing or validating shortcode attributes to prevent script injection. Since no explicit security mitigations are present in the plugin code, disabling the plugin or limiting access to users with editing permissions is recommended until an update is available. [1]