SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Mp3 Music Player By Sonaar — verificado contra la base de datos de seguridad local de WP Clinic.
mp3-music-player-by-sonaaraudio playermp3music playerPodcast Playerwoocommerce
14 CVEs conocidos registrados para Mp3 Music Player By Sonaar.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-39647 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.12 | — | Media 5,4 | < 5.12 | 5.12 | 2026-02-15 | — |
| CVE-2025-32235 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9.5 | Falta de control de autorización | Media 4,3 | < 5.9.5 | 5.9.5 | 2025-04-04 | — |
| CVE-2024-13157 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 5.9.4 | 5.9.4 | 2025-01-30 | — |
| CVE-2024-56266 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9 | Falta de control de autorización | Media 6,3 | < 5.9 | 5.9 | 2024-12-30 | — |
| CVE-2024-10268 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 5.9 | 5.9 | 2024-11-18 | — |
| CVE-2024-7856 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.7.1 | Falta de control de autorización | Alta 8,1 | < 5.7.1 | 5.7.1 | 2024-08-28 | — |
| CVE-2024-5664 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 5.6 | 5.6 | 2024-07-09 | — |
| CVE-2024-31343 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.0 | Falta de control de autorización | Alta 7,5 | < 5.0 | 5.0 | 2024-04-05 | — |
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.11. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Podcast RSS Feed in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible when wp-config.php is deleted.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin to the latest available version (at least 5.0). Yudistira Arya discovered and reported this Arbitrary File Download vulnerability in WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin. This could allow a malicious actor to download any file from your website. This includes but is not limited to files that contain login credentials or backup files. This vulnerability has been fixed in version 5.0. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2024-30530 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.1.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 5.1.1 | 5.1.1 | 2024-03-29 | — |
| CVE-2024-30487 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.1.1 | Falta de control de autorización | Alta 7,6 | < 5.1.1 | 5.1.1 | 2024-03-28 | — |
| CVE-2023-47822 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 4.10.1 | Falta de control de autorización | Media 5,4 | < 4.10.1 | 4.10.1 | 2023-11-15 | — |
| CVE-2021-24624 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 2.4.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 2.4.2 | 2.4.2 | 2021-10-04 | — |
| CVE-2026-1219 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.11 | — | Desconocido | < 5.11 | 5.11 | 0000-00-00 | — |
| CVE-2026-1249 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.11 | — | Desconocido | < 5.11 | 5.11 | 0000-00-00 | — |
Update the WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin to the latest available version (at least 5.1.1). Steven Julian discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 5.1.1. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin to the latest available version (at least 5.1.1). Steven Julian discovered and reported this Broken Access Control vulnerability in WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 5.1.1. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin to the latest available version (at least 4.10.1). Abdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 4.10.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.