CVE-2025-48168

The plugin Apollo - Sticky Full Width HTML5 Audio Player (lbg-audio5-html5-shoutcast-sticky) for WordPress versions up to and including 3.4 contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1].

Attackers can exploit this issue by crafting a malicious link or form that, when clicked or submitted by a privileged user (such as an administrator), injects arbitrary HTML or JavaScript into the page. User interaction is required for successful exploitation [1].

The injected script can perform actions like redirecting visitors, displaying advertisements, or stealing session cookies. This could lead to defacement, phishing, or further compromise of the WordPress site [1]. The CVSS score is 7.1, reflecting moderate severity.

To mitigate the vulnerability, the vendor has released version 3.6.4 which includes a fix. Users are strongly advised to update immediately. Patchstack also provides a mitigation rule for those unable to update right away [1]. Given that this vulnerability is expected to be used in mass-exploit campaigns, prompt action is recommended [1].