The identified weakness lies in the txtalbum parameter of the file /Administrator/PHP/AdminAddAlbum.php in code‑projects for Plugin. The lack of input validation allows an attacker to embed malicious scripts that execute in users’ browsers. This is a classic cross‑site scripting vulnerability, classified under CWE‑79 and CWE‑94. An attacker could steal session cookies, deface the web interface, or redirect visitors to phishing sites, potentially escalating to broader compromise of the user’s session and data.

The information indicates that the flaw affects version 1.0 of the code‑projects for Plugin, which is used within fabian’s online_music_site 1.0 as reflected by the CPE mapping. The exact release of the vulnerable plugin is not explicitly stated, so all installations containing the plugin, especially recent ones, should be verified for the presence of this flaw.

The CVSS v3.1 score of 4.8 places the issue in the moderate severity range. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation in the field at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The vector is remote; an attacker only needs to craft a request that manipulates txtalbum with malicious payload, which can be performed from any external host. Successful exploitation grants client‑side code execution, which could lead to theft of session data, defacement, or further attacks on the site’s users. Administrators should treat the risk as moderate pending a vendor fix, while monitoring may suffice for low‑risk environments.