The fyyd podcast shortcodes plugin for WordPress contains a Stored XSS vulnerability, classified as CWE‑79. The plugin concatenates user‑supplied values from shortcode attributes—such as 'color', 'podcast_id', and 'podcast_slug'—directly into inline JavaScript without sanitization or escaping, allowing an attacker to break out of the string context and inject arbitrary script. When the malicious code is stored in a post or page, it executes automatically whenever any user views that content, providing a vector for session hijacking, credential theft, or further site compromise.

All WordPress sites running the cbednarek fyyd podcast shortcodes plugin, version 0.3.1 or earlier, are vulnerable. The flaw applies to the 'fyyd‑podcast', 'fyyd‑episode', and 'fyyd' shortcodes that expose the vulnerable attributes.

The flaw carries a medium CVSS score of 6.4, with no EPSS data available and it is absent from the CISA KEV catalog. Exploitation requires an authenticated user with Contributor-level or higher access and the ability to insert a malformed 'color' attribute into a shortcode. Once stored, the injected script runs for any visitor to the affected page, offering attackers a persistent and widespread attack surface.