The WordPress Sticky Radio Player plugin contains an improper neutralization of input during page generation, which leads to a reflected cross‑site scripting vulnerability as defined by CWE‑79. A malicious actor can inject script code into requests that are reflected back in the plugin’s output, potentially allowing arbitrary JavaScript execution in the context of a visitor’s browser. The description does not explicitly state downstream effects, but it is inferred that executing JavaScript in the victim’s session could compromise session integrity or deface the site.

The flaw affects the Sticky Radio Player plugin from LambertGroup for WordPress, impacting every release up to and including version 3.4. Administrators should confirm the installed version and upgrade if a later patched release exists.

The CVSS score of 7.1 signals a high potential impact, whereas the EPSS score of less than 1 % indicates a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalogue. The attack vector is inferred to be reflected, requiring a user to visit a crafted URL or submit malicious input that the plugin echoes back to the browser.