WPRadio – WordPress Radio Streaming Plugin
WPRadio – WordPress Radio Streaming Plugin has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WPRadio – WordPress Radio Streaming Plugin has a vendor fix available, so running the current release closes it.
All of these findings were reported by zakaria. WPRadio – WordPress Radio Streaming Plugin is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2024-13397WPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WPRadio – WordPress Radio Streaming Plugin
Author
Caster.fm
WordPress Radio is the only WordPress plugin that creates an entire radio streaming platform within your WordPress site. It utilizes Caster.fm Cloud API to allow you to create an internet radio station and provide a management interface for the streaming server, listeners, widgets and podcasts management. And the best part is, it is FREE! Features Server & Broadcast Management: Start and the stop the streaming server, view multi-channel real time broadcast status and meta-data, change meta-data and drop broadcast source and view real-time listeners stats… All within the app dashboard. Live Listeners Information: View your listeners information in real time, including connection duration, the device they are using to listen and the ability to drop specific listener. Recorded Podcasts Management: Listen to, rename and delete your automatically recorded podcasts. Live Stream and Recorded Podcasts Players Shortcodes Generator: Customize the provided widgets / players and generate shortcodes for usage within your WordPress site. Affiliates If you’re a WordPress hosting company you can register as an affiliate to offer Caster.fm API service as your own and get a share of the revenue from your subscribers. Learn More About Caster.fm API Affiliates Program After obtaining an affiliate id you can insert it at the WordPress Radio page within the Network Admin section. This will make sure all your hosted WordPress sites will be redirected to your registration gateway URL when prompted for an API private token. Development The javascript and css source files are located within the Admin/assets directory and uses Laravel Mix for assets management/compilation. To build those you’ll need to install NodeJS and NPM. After which cd to the assets directory and execute the following command: npm install npm run dev This will compile the assets and publish them at the parent directory.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C