The Broadcast Live Video – Live Streaming WordPress plugin (up to version 6.1.9) contains a stored cross-site scripting vulnerability (CWE-79) in the 'videowhisper_hls' shortcode. This flaw is due to inadequate sanitization and escaping of user-supplied attributes, enabling authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. There is no vendor patch or advisory currently available, and no known exploitation in the wild has been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially allowing theft of session tokens, defacement, or other malicious actions affecting confidentiality and integrity. Availability is not impacted. The vulnerability requires authenticated access, limiting exposure to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level and higher user privileges to trusted users only. Consider disabling or removing the vulnerable shortcode if possible. Monitor official videowhisper channels and WordPress plugin repositories for updates or patches addressing this vulnerability.