Descripción
The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all versions up to, and including, 1.1.5 due insufficient input sanitization output escaping. This makes it possible authenticated attackers, with Contributor-level access above, inject arbitrary web scripts pages that will execute whenever a user accesses an injected page.
https://plugins.trac.wordpress.org/browser/streamweasels-kick-integration/trunk/public/partials/streamweasels-kick-vods-public-display.php#L44
https://plugins.trac.wordpress.org/changeset/3355340#file4
https://wordpress.org/plugins/streamweasels-kick-integration/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/4a433565-0896-4ba9-a718-9507c6c4ba58?source=cve
