CVE-2025-5589 is a stored cross-site scripting vulnerability in the StreamWeasels Kick Integration WordPress plugin affecting all versions up to 1.1.3. The flaw exists in the handling of the 'status-classic-offline-text' parameter, which lacks proper input sanitization and output escaping. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with Contributor-level access or above to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to information disclosure and integrity issues within the affected WordPress site. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the StreamWeasels Kick Integration plugin if possible. Monitor vendor channels for updates regarding patches or official mitigations.