The WPRadio – WordPress Radio Streaming Plugin (versions up to 1.0.4) contains a stored cross-site scripting vulnerability (CWE-79) in its 'wpradio_player' shortcode. This vulnerability is due to improper neutralization of user-supplied input, specifically insufficient sanitization and escaping, which allows authenticated users with contributor-level permissions or higher to inject arbitrary web scripts. These scripts are stored and executed when other users access the injected pages, potentially compromising user sessions or data. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation has been documented in the provided data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users visit these pages, the scripts execute in their browsers, potentially leading to session hijacking, data theft, or other malicious actions affecting confidentiality and integrity. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WPRadio plugin if feasible. Monitor for updates from the vendor or security advisories to apply patches promptly once released.