PT-2026-42728 · WordPress · Kia Subtitle

Djaidja Moundjid · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-7509

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KIA Subtitle plugin for WordPress versions prior to 4.0.2

Description The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the before and after attributes of the the-subtitle shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 4.0.1. As a temporary workaround, restrict the use of the before and after attributes in the the-subtitle shortcode for users with Contributor-level access.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7509

Affected Products

Kia Subtitle

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-7509 · Security Note
• https://plugins.trac.wordpress.org/browser/kia-subtitle/trunk/kia-subtitle.php#L329 · Note
• https://plugins.trac.wordpress.org/browser/kia-subtitle/trunk/kia-subtitle.php#L359 · Note
• https://twitter.com/CVEnew/status/2057783179159695538 · Twitter Post
• https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.1/kia-subtitle.php#L359 · Note
• https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.2/kia-subtitle.php#L369 · Note
• https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.1/kia-subtitle.php#L329 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a9a52097-0d85-4036-9b74-f35fea549607?source=cve · Note
• https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.2/kia-subtitle.php#L370 · Note