The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'align' attribute of its Gutenberg block 'wp:radio-player'. This vulnerability allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript code into pages. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other client-side attacks. The issue arises from inadequate input sanitization and output escaping in versions up to and including 2.0.78. The CVSS 3.1 base score is 6.4, reflecting a medium impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information provided, and no known active exploitation has been documented.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable 'align' attribute. This can lead to unauthorized actions performed in the context of other users who view the infected pages, compromising confidentiality and integrity of user sessions or data. There is no indication of availability impact. The vulnerability requires authenticated access, limiting exposure to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the vulnerable Gutenberg block if feasible. Monitor official channels from the plugin vendor for updates or patches addressing this vulnerability.