The Wikiloops Track Player plugin for WordPress suffers from a stored cross‑site scripting flaw that is triggered when an authenticated user inserts malicious data into the attributes of the "wikiloops" shortcode. The plugin fails to escape or sanitize user‑supplied input, allowing an attacker to embed arbitrary JavaScript that is persisted in the post content and executed whenever any user visits the affected page.

Any WordPress installation that runs jmrukkers' Wikiloops Track Player version 1.0.1 or earlier and has users with contributor or higher privileges. The vulnerability is present in all versions up to and including 1.0.1.

The flaw has a CVSS score of 6.4, indicating a moderate impact, and an EPSS score of less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be authenticated, requiring a contributor‑level role or higher to inject malicious shortcode attributes. Once injected, the script runs in the context of any visitor’s browser, potentially leaking session data or performing malicious actions on behalf of the user.