An attacker can store malicious script code within the Audio Album plugin, which is later executed in the browsers of users who view the protected pages. The vulnerability is a classic stored cross‑site scripting flaw that can lead to session hijacking, defacement, or phishing attacks against visitors, undermining the confidentiality and integrity of user data.

WordPress plugin "Audio Album" from vendor cubecolour, any version up to and including 1.5.0. The flaw affects all revisions of the plugin belonging to this version series.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue, suggesting no widely known public exploits. The likely attack vector would involve an attacker who can submit content or manage the plugin’s data store, such as a user with editorial privileges or an automated script that inserts malicious payloads into the plugin’s database.