The WordPress WS Audio Player plugin exposes a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to inject and store malicious JavaScript within the plugin’s data. Once stored, the code executes in the browsers of any user who views the affected audio content, enabling cookie theft, site defacement, or further malicious actions in the context of authenticated visitors. This stored XSS capability relates to CWE‑352, highlighting a failure to validate request authenticity.

The vulnerability affects the icyleaf WS Audio Player plugin for WordPress from its earliest releases up through version 1.1.8. Users running any of these versions are potentially exposed; the problem is present throughout the feature set that manages audio content embedding.

Based on the CVSS score of 7.1, the flaw represents high severity. The EPSS score is less than 1 %, indicating minimal recent exploitation activity, and the issue is not catalogued in the CISA KEV list. The attack vector is a CSRF request that requires the victim to be logged in and to unknowingly submit a crafted URL or form that the plugin processes, leading to stored XSS. The overall risk remains significant for sites that continue to run affected plugin versions or allow unfiltered user input to the plugin’s storage.