The Live Stream Badger plugin allows authenticated users with contributor‑level permissions or higher to insert arbitrary web scripts into the 'livestream' shortcode via unsanitized attributes. Those scripts are stored and will execute in the browsers of any site visitor who loads a page containing the injected shortcode. The exploit does not grant direct code execution on the server, but it can compromise the integrity of visited pages and potentially affect user session data or other client‑side resources as the attacker controls the injected script.

WordPress installations that use the tkrivickas Live Stream Badger plugin version 1.4.3 or any earlier release are affected. All releases up to and including 1.4.3 contain the flaw.

The CVSS score of 6.4 classifies the issue as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not included in the CISA KEV catalog. Attackers must be authenticated and possess at least contributor-level privileges to insert malicious attributes, after which the injected scripts run in any user’s browser that views the affected page.