The vulnerability is a stored cross‑site scripting flaw that lets an attacker inject and persist malicious scripts within the WordPress Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com. Once injected, the code executes in the browser of any visitor who views the affected content, potentially allowing session hijacking, defacement, or the delivery of secondary payloads. The weakness is classified as CWE‑79 and requires the attacker to supply input that is not properly neutralized before rendering on the webpage.

The affected product is the WordPress plugin Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com, controlled by the vendor yesstreamingdev. All releases up to and including version 3.3 are impacted. Users running any of these versions on a WordPress site are potentially susceptible.

The CVSS score of 5.9 denotes a medium severity exposure, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker can exploit the flaw by submitting malicious content that is stored by the plugin and later rendered to other site visitors, typically via the plugin's configuration or streaming comment fields. Given the stored nature of the XSS, the attack does not require elevated privileges beyond the ability to submit input to the plugin.