The Listeo - Directory & Listings With Booking WordPress theme is affected by a stored cross-site scripting vulnerability (CWE-79) via the soundcloud shortcode. This occurs due to improper neutralization of input during web page generation, allowing authenticated contributors or higher to inject arbitrary scripts. The vulnerability affects versions up to and including 2.0.8. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity with no impact on availability.

Successful exploitation allows an authenticated user with contributor-level privileges or higher to inject malicious scripts into pages, which execute in the context of other users viewing those pages. This can lead to unauthorized disclosure or modification of information accessible to users. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or restricting use of the soundcloud shortcode. Monitor for updates from the theme vendor or WordPress security channels for patches addressing this vulnerability.