Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

LambertGroup Sticky Radio Player may let attackers inject scripts

CVE-2025-31426 · published 1 year ago
Summary

The Sticky Radio Player (versions up to 3.4) does not properly clean data it shows on web pages, so a crafted link can cause malicious code to run in a visitor’s browser. This could let an attacker steal information or act as the user on the site. Update to the latest version or apply the vendor's fix and avoid clicking unknown links that point to the player.

Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This is...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Jun 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-31426 · NVD
Track software like this
Free during beta