CVE-2026-111967
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
| Vendor | unknown |
| Product | mp3 audio player |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown mp3 audio player
Be the first to know when new medium vulnerabilities affecting unknown mp3 audio player are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / MP3 Audio Player
5.9 < 5.16
References
Credits
Hexxed BitHeadz WPScan