The Listen Shortcode plugin for WordPress is vulnerable to stored cross‑site scripting via the 'listen' shortcode. The vulnerability stems from inadequate sanitization and escaping of user‑supplied attributes (src, start, end) inside the listenEmbedJS() function, causing the attributes to be echoed unescaped within a single‑quoted HTML attribute. An attacker can inject arbitrary JavaScript that will run whenever any user views a page containing the malicious shortcode, potentially compromising the confidentiality and integrity of the site.

The issue affects the Listen Shortcode plugin supplied by konforti, specifically versions up to and including 1.0. The plugin is a WordPress extension that embeds content via shortcodes; users of these versions are vulnerable.

With a CVSS score of 6.4, the vulnerability presents a moderate risk. The popular WordPress architecture, combined with contributor‑level access as the minimum requirement, allows authenticated users to inject the payload. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating that the exploitation likelihood is not currently documented in national threat feeds. An attacker would need to create or edit a page or post that contains the compromised shortcode; once the page is accessed by visitors, the payload executes in the context of the site.