A reflected cross-site scripting vulnerability in the LambertGroup Radio Player Shoutcast & Icecast plugin allows unauthenticated attackers to execute arbitrary scripts in a user's browser.

This is a reflected cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The vulnerability is exploitable by an unauthenticated attacker who can trick a user into clicking a crafted link.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of the victim's session, potentially leading to session hijacking, unauthorized actions, or the theft of sensitive user data. With a CVSS score of 7.1, this represents a high risk to the confidentiality and integrity of web application users.

Immediate Action: Since a specific patch version is not currently identified, users should monitor the vendor advisory for updates and consider disabling or removing the plugin if it is not business-critical.

Proactive Monitoring: Review web access logs for suspicious URL parameters containing script tags or encoded characters that may indicate XSS probing.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns in incoming HTTP requests.

Public Exploit Available: Unknown.

Given the high CVSS severity, organizations should treat this vulnerability with urgency. Administrators must keep the plugin updated to the latest version as soon as the vendor releases a fix, while utilizing WAF filtering as a temporary measure to reduce the attack surface.