Executive brief
The Listen Shortcode plugin for WordPress, which allows users to embed audio content, contains a security flaw that allows authenticated users to inject malicious scripts into website pages. An attacker with contributor-level access or higher can use this vulnerability to run unauthorized code in the browsers of other visitors. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.
Technical details
The Listen Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the listenEmbedJS() function. Specifically, user-supplied attributes such as 'src', 'start', and 'end' are echoed directly into single-quoted HTML attributes without proper escaping. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute in the context of any user who views the affected page. The vulnerability exists in all versions up to and including 1.0.
Affected products
- WordPress Listen Shortcode Up to and including 1.0
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory