The vulnerability is an improper neutralization of user input during web page generation, resulting in a reflected Cross‑Site Scripting (XSS) flaw that allows an attacker to inject malicious scripts into a web page rendered by the Apollo - Sticky Full Width HTML5 Audio Player. According to the description, the flaw is listed as CWE‑79 and could allow an attacker to execute arbitrary scripts in the context of the victim’s browser, leading to client‑side compromise.

The affected product is the LambertGroup Apollo - Sticky Full Width HTML5 Audio Player plugin for WordPress, with all releases from the earliest available version up to and including 3.4. No precise lower bound is provided, but every installed instance running a version 3.4 or earlier is vulnerable.

The CVSS score of 7.1 indicates a high impact with potential for widespread exploitation. The EPSS score of less than 1% suggests a low probability of exploitation at present; the vulnerability is also not listed in CISA KEV. The likely attack vector is a reflected XSS scenario where a crafted URL or input field is supplied by the attacker, triggering script execution in the victim’s browser. Based on the description, it is inferred that this flaw can be triggered without authentication, relying on the plugin’s inadequate input sanitization.