The Listeo WordPress theme contains a stored cross‑site scripting flaw in the soundcloud shortcode. The shortcode does not sanitize or escape user‑supplied attributes, allowing an authenticated contributor to inject arbitrary JavaScript into a page. When a visitor loads the page, the malicious script executes in the context of the site, enabling credential theft, defacement, or malicious redirects. The weakness is a classic XSS scenario that compromises user integrity and confidentiality.

Products affected are purethemes’ Listeo Directory & Listings With Booking WordPress theme, specifically any installation using version 2.0.8 or earlier. The issue is confined to the theme’s built‑in shortcode and does not involve other plugins or core WordPress components.

The CVSS score of 6.4 categorizes the flaw as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers require only contributor‑level access or higher, a common role granted to content authors, making the attack path straightforward. Once the payload is stored, all users who view the affected page will be exposed to the injected script.