CVE-2025-9877 is a stored cross-site scripting vulnerability in the Embed Google Datastudio WordPress plugin, affecting all versions up to 1.0.0. The issue stems from improper neutralization of input in the 'egds' shortcode, where user-supplied attributes are not properly sanitized or escaped before being rendered in web pages. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This can lead to partial confidentiality and integrity impacts, such as theft of user credentials or session tokens. The vulnerability does not affect availability and requires low attack complexity with no user interaction needed beyond viewing the injected page.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure or session hijacking. The confidentiality and integrity of user data may be compromised, but there is no direct impact on system availability. The vulnerability requires authenticated access, limiting exploitation scope to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher access to trusted users only. Consider disabling or removing the Embed Google Datastudio plugin if it is not essential. Monitor plugin updates from the vendor for a security patch addressing this issue.