{"id":"CVE-2025-23854","aliases":["EUVD-2025-3477","GHSA-rh5p-hcx7-6rc7"],"status":"published","title":"WordPress Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com plugin \u003c= 3.3 - Cross Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through \u003c= 3.3.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00392,"percentile":0.33612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-01-16T20:07:26Z","modified":"2026-06-17T08:57:37Z","products":[{"vendor":"yesstreaming.com shoutcast and icecast internet radio hosting","product":"shoutcast and icecast html5 web radio player by yesstreaming.com"},{"vendor":"yesstreamingdev","product":"shoutcast and icecast html5 web radio player by yesstreaming.com"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com/vulnerability/wordpress-shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23854"},{"url":"https://patchstack.com/database/wordpress/plugin/shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com/vulnerability/wordpress-shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-rh5p-hcx7-6rc7"}],"sources":{"cve":[{"id":"CVE-2025-23854","title":"WordPress Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com plugin \u003c= 3.3 - Cross Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through \u003c= 3.3.","status":"published","published":"2025-01-16T20:07:26.651Z","modified":"2026-05-11T22:47:04.534Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:33.082076Z"}],"euvd":[{"id":"EUVD-2025-3477","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through \u003c= 3.3.","status":"published","published":"2025-01-16T20:07:26Z","modified":"2026-05-11T22:47:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:04:42.120376Z"}],"ghsa":[{"id":"GHSA-rh5p-hcx7-6rc7","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YesStreaming.com Shoutcast and Icecast Internet Radio Hosting Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through 3.3.","status":"published","published":"2025-01-16T21:31:04Z","modified":"2025-01-16T21:31:12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:59:34.646731Z"}],"nvd":[{"id":"CVE-2025-23854","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yesstreamingdev Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com allows Stored XSS.This issue affects Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com: from n/a through \u003c= 3.3.","status":"published","published":"2025-01-16T21:15:25.357Z","modified":"2026-06-17T08:57:37.387Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:48.713733Z"}]}}