The AudioTube WordPress plugin is affected by a stored cross‑site scripting flaw that originates from the "caption" attribute of the "audiotube" shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript into the attribute, which is then executed in the browsers of any visitor to the affected page. This can lead to defacement, credential theft, session hijacking, or redirecting users to malicious sites, thereby compromising the confidentiality, integrity, and user experience of the site.

All installations of the AudioTube plugin from davidangel, version 0.0.3 or earlier, used on any WordPress site that grants contributor or higher access to users. Sites running these plugin versions and allowing contributors to edit content are directly impacted.

The CVSS score of 6.4 reflects moderate severity. EPSS is reported as < 1%, indicating that the real‑world exploitation probability is currently low and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an authenticated contributor or higher and the attacker must edit or create a post that contains the vulnerable shortcode. Once the payload is stored, any site visitor will trigger the malicious script when loading the page. The risk is mitigated only by applying a patch or disabling the vulnerable functionality.