Stored Cross-Site Scripting Vulnerability in WPRadio WordPress Plugin
CVE-2024-13397

6.4MEDIUM

Key Information:

Vendor
Casterfm
Status
WPradio – WordPress Radio Streaming Plugin
Vendor
CVE Published:
31 January 2025

Summary

The WPRadio plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its 'wpradio_player' shortcode. This flaw allows authenticated attackers with contributor-level access and above to exploit insufficient input sanitization and output escaping on user-supplied attributes, enabling them to inject arbitrary web scripts. Consequently, when other users access compromised pages, the malicious scripts are executed, posing significant risks to site security and user data integrity.

Affected Version(s)

WPRadio – WordPress Radio Streaming Plugin * <= 1.0.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpradio/trunk/...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zakaria
.