Stored Cross-Site Scripting Vulnerability in Icecast HTML5 Radio Player Plugin for WordPress

CVE-2024-8666

What is CVE-2024-8666?

The Shoutcast Icecast HTML5 Radio Player plugin for WordPress presents a security vulnerability enabling Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the plugin's 'html5radio' shortcode. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious scripts into web pages, leading to potential unauthorized script execution whenever a user visits the affected page. It is crucial for website administrators to review their installations and apply necessary updates to mitigate potential security risks.

References