CVE-2025-53205
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through <= 4.4.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Reflected XSS vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress plugin allows attackers to inject malicious scripts via crafted requests.
Vulnerability
Description The Radio Player Shoutcast & Icecast plugin (lbg-audio4-html5-shoutcast) for WordPress suffers from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This affects all versions up to and including 4.4.7. [1]
Exploitation
An attacker can exploit this vulnerability by crafting a malicious link that, when clicked by a privileged user such as an administrator, causes the injected script to execute. The attack does not require authentication, but user interaction is necessary. [1]
Impact
Successful exploitation allows the attacker to inject arbitrary HTML and JavaScript into the page, potentially leading to redirects, unwanted advertisements, or other malicious actions affecting site visitors and compromising the site's integrity. [1]
Mitigation
The vulnerability has been addressed in version 4.4.8. Users are strongly advised to update the plugin immediately. In case an immediate update is not possible, Patchstack provides a mitigation rule to block attacks until the update is applied. [1]
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=4.4.7
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.