The WaveSurfer‑WP plugin for WordPress contains a stored cross‑site scripting flaw that arises from insufficient input sanitization and output escaping on the ‘src’ attribute of its audio shortcode. An authenticated attacker possessing at least Contributor level can embed arbitrary JavaScript code in the ‘src’ field, which will be processed and rendered by the plugin. When a page containing the injected shortcode is viewed, the malicious script executes in the victim’s browser.

All deployments of the WaveSurfer‑WP plugin developed by x‑raym with a version number of 2.8.3 or earlier are vulnerable. The flaw exists in every release up to and including 2.8.3, and does not affect later or other plugin versions.

The CVSS base score of 6.4 classifies the vulnerability as moderate severity. The EPSS score is below 1 %, indicating a low current probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have authentication at the Contributor level or higher; once a malicious payload is stored, it remains present and is delivered to all page viewers until removed or the plugin is updated.