The ZoomSounds WordPress plugin contains a stored cross‑site scripting (XSS) flaw that originates from insufficient sanitization of user-supplied attributes in shortcodes. An authenticated user with contributor‑level or higher privileges can inject arbitrary JavaScript into a generated page via a crafted shortcode. When another site visitor loads that page, the injected script runs in their browser, potentially stealing session cookies, defacing the site, or redirecting the user to malicious sites. The impact is a loss of confidentiality and integrity for all users who view the affected pages.

The vulnerability affects the ZoomSounds WordPress Wave Audio Player with Playlist plugin from ZoomIt, specifically versions up to and including 6.91. Any WordPress installation running ZoomSounds 6.91 or earlier is at risk.

With a CVSS score of 6.4, the flaw rates as medium severity, and an EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It requires an authenticated user with at least contributor rights to inject the malicious shortcode, so the attack vector is an authenticated web‑application access scenario. Although exploitation is unlikely, the potential impact of a successful XSS makes this a serious concern for any site using affected versions.