CVE-2025-7809 is a stored cross-site scripting vulnerability in the StreamWeasels Twitch Integration plugin for WordPress. The flaw exists in the handling of the 'data-uuid' attribute, where user input is not properly sanitized or escaped before being included in web pages. This allows authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code that executes in the context of other users viewing the injected pages. The vulnerability affects all plugin versions up to and including 1.9.3. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into pages, potentially leading to session hijacking, defacement, or other client-side attacks against users who view the compromised pages. The confidentiality and integrity of user data can be partially impacted, but availability is not affected.

Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should check the vendor's official advisory for updates and apply any available fixes promptly. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible to prevent exploitation.