The Html5 Audio Player plugin for WordPress contains an improper neutralization of input during web page generation, allowing an attacker to store malicious script code that executes when users view pages rendered by the plugin. This stored cross-site scripting can be used to steal session cookies, deface content, or perform other malicious actions within the scope of the vulnerable site. The weakness is a classic XSS flaw and is enumerated as CWE-79.

Any WordPress installation that has installed the bPlugins Html5 Audio Player plugin version 2.8.8 or earlier is impacted. The vulnerability is present from the initial release up through version 2.8.8, covering all products listed under bPlugins:Html5 Audio Player.

The CVSS score of 6.5 indicates a medium risk level, while no EPSS score is currently available, so the likelihood of exploitation cannot be quantified beyond general XSS threats. The vulnerability is not listed in the CISA KEV catalog, but stored XSS is a well-known attack vector. The attack likely occurs when an authenticated user with the ability to create or edit plugin content injects malicious JavaScript, which is then rendered on pages for all visitors.