The Last.fm Recent Album Artwork plugin for WordPress contains a missing or incorrect nonce check on its settings page, allowing an attacker to forge a request that updates the plugin’s configuration. By exploiting this vulnerability, a malicious actor can inject arbitrary JavaScript that will be stored in the site’s settings and executed in the browsers of any user who views the affected page. The impact is the compromise of confidentiality and integrity of site data and the potential to hijack administrator sessions, deface the site, or exfiltrate sensitive information through client‑side scripts.

All installations of the remysharp:Last.fm Recent Album Artwork plugin, versions 1.0.2 and earlier, running on WordPress websites. The vulnerability is present regardless of the overall WordPress core version, as it resides in the plugin’s PHP script accessed by site administrators.

The CVSS score of 6.1 categorizes the issue as a moderate severity flaw. The EPSS score of less than 1 % indicates a very low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only that an administrator click a crafted link or form, making social engineering a viable vector. Once executed, the stored XSS can affect all users of the site, elevating the risk in environments with sensitive or privileged users. The lack of immediate automatic exploitation mechanisms means the attacker must first persuade a target administrator to perform the forged request.