The WP SoundSystem plugin’s wpsstm‑track shortcode accepts user‑supplied attributes that are stored without proper sanitization or escaping. Based on the description, it is inferred that an attacker with contributor‑level or higher access can inject arbitrary JavaScript into these attributes. When a visitor loads any page that contains the injected shortcode, the malicious script runs in the visitor’s browser, potentially stealing credentials, defacing content, or performing other malicious actions. The vendor’s documentation does not specify exact confidentiality or integrity effects, but the ability to execute arbitrary code in users’ browsers is a clear security risk. This flaw is classified as CWE‑79.

All sites running the WP SoundSystem WordPress plugin version 3.4.2 or earlier, developed by grosbouff, are susceptible. The vulnerability arises only when the wpsstm‑track shortcode is used within post or page content, so sites that do not employ that shortcode are not affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of <1% suggests a very low likelihood of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the attacker to have authenticated contributor or higher access to edit content containing the shortcode. Successful exploitation would cause the injected script to execute on every visit to the affected page, giving the attacker the ability to hijack user sessions or deface the site. Because the impact is limited to users who view the compromised content, the risk is mitigated by access controls but remains significant for sites with publicly accessible content.