The ZoomSounds - WordPress Wave Audio Player with Playlist plugin suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, user-supplied shortcode attributes are not adequately sanitized or escaped, enabling authenticated contributors or higher to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions up to and including 6.91. No known exploits in the wild have been reported, and no patch or official fix has been documented as of the publication date.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The impact is limited to confidentiality and integrity loss of user data accessible via the browser. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling the ZoomSounds plugin if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.