CVE Database /
CVE-2024-10268
CVE · Medium
CVE-2024-10268 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-10268
|
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 5.9
|
5.9 |
2024-11-18 |
—
|
CVE-2024-10268
The MP3 Audio Player plugin by Sonaar contains a stored cross-site scripting vulnerability in its sonaar_audioplayer shortcode affecting versions 5.8 and earlier. Authenticated users with contributor access or higher can inject malicious scripts through the shortcode's attributes because the plugin fails to properly sanitize inputs and escape outputs. These injected scripts will execute in the browsers of any visitor viewing the affected page.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings