The Audio Player Block plugin fails to validate the scheme of a user‑supplied URL before using it as a link target. A user with Contributor role or higher can store malicious JavaScript that is executed in the browser session of any user who later triggers the link, such as an administrator or editor. This creates a stored XSS scenario that can lead to credential theft, session hijacking, or arbitrary code execution in the user’s context.

WordPress sites running the Audio Player Block plugin in versions 1.1.0 through 1.6.2 are affected. The flaw requires the ability to add or edit audio URLs within the block, a capability granted to Contributor or higher roles. Any site that has not upgraded past 1.6.2 remains vulnerable.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so no current public exploit activity has been reported. The CVSS score of 6.8 indicates medium severity, but the impact is significant because the attacker can persist malicious code in the database and trigger it whenever any privileged user interacts with the audio block. The likelihood of exploitation is reasonable due to the common use of the Contributor role and the ease of embedding a malicious URL. It is advisable to treat this as a moderate‑risk flaw pending a fix.