Stored Cross-Site Scripting Vulnerability in WP SoundSystem Plugin for WordPress

CVE-2025-6258

What is CVE-2025-6258?

The WP SoundSystem plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access or above to exploit the plugin's wpsstm-track shortcode. Due to inadequate input sanitization and output escaping on user-supplied attributes, attackers can inject arbitrary scripts into web pages. These scripts are executed when unwitting users visit the compromised page, posing significant risks to site integrity and user security. This highlights the critical importance of implementing robust security practices in web application development.

References