The Listen Shortcode plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin's listenEmbedJS() function fails to adequately sanitize and escape user-supplied attributes (src, start, end) used in the 'listen' shortcode. These attributes are embedded inside a single-quoted HTML attribute without escaping, allowing authenticated users with contributor-level permissions or higher to inject malicious scripts. When other users access the compromised pages, the injected scripts execute, potentially leading to information disclosure or session hijacking. The vulnerability is tracked as CVE-2026-8887 with a CVSS 3.1 score of 6.4 (medium severity). No patch or official remediation has been published by the vendor as of the current information.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the context of users viewing the pages, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting its scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Listen Shortcode plugin if possible to prevent exploitation.