The vulnerability is an improperly sanitized input during web page generation that allows a Reflected Cross‑Site Scripting (XSS) attack. An attacker can supply malicious JavaScript in a URL or form field that is echoed back in the page without encoding. If executed, the script runs in the context of users who view the page, leading to potential phishing, cookie theft, or session hijack.

LambertGroup SHOUT plugin, version 3.5.3 and earlier, including variants shipped with the lbg‑audio8-html5-radio_ads package. The issue affects all installations that have not upgraded beyond 3.5.3.

The CVSS score of 7.1 indicates a high severity level. The EPSS score is reported at less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is a Reflected XSS that can be triggered by a crafted request, an attacker with internet access could target any exposed site running the affected plugin. If the target user’s browser executes the reflected script, the attacker can hijack the session or redirect the user to malicious content.