The Soundslides WordPress plugin has a stored XSS flaw that allows an authenticated user with Contributor or higher privileges to insert malicious JavaScript into shortcode attributes. Because the plugin does not properly sanitize or escape user‑supplied data, the payload is written to the database and rendered unescaped in the generated page, enabling arbitrary script execution in a visitor’s browser. An attacker can deface content, steal session cookies, or perform other client‑side attacks on all users who view the affected page; the weakness is a classic input validation flaw (CWE‑79).

All installations of Soundslides version 1.4.2 or earlier are vulnerable. WordPress sites using the 'soundslides' shortcode in posts, pages, or widgets are at risk, regardless of the overall WordPress or plugin settings. The vulnerability applies to any contributor‑level user who can add or edit content containing the shortcode. The vendor list identifies the product as wpoets:Soundslides; no additional version ranges are specified beyond 1.4.2.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. The flaw is not listed in CISA KEV, but its low exploitation likelihood does not negate the fact that any site granting Contributor access could be abused. Because authentication is the only prerequisite and the injection is stored, an attacker can launch the payload with minimal effort once authenticated, and all visitors to the affected pages will be impacted.