CVE Database /
CVE-2024-5664
CVE · Medium
CVE-2024-5664 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.6
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-5664
|
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar] < 5.6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 5.6
|
5.6 |
2024-07-09 |
—
|
CVE-2024-5664
The MP3 Audio Player plugin for WordPress contains a security flaw affecting all versions up to 5.5. The issue arises from inadequate validation of user-provided data within the sonaar_audioplayer shortcode's 'id' attribute, allowing malicious scripts to be embedded in pages that will run when accessed by users. This vulnerability can be exploited by authenticated attackers with contributor-level access or higher.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings