Sonaar MP3 Player CVE-2026-104673

Exploitation requires an authenticated account with at least low privileges (PR:L) capable of reaching a Sonaar MP3 Audio Player input field that stores content, plus a subsequent victim loading the rendered page (UI:R). The limiting factors are: the attacker must already have a valid, low-privilege account on the target WordPress site, the payload only triggers when another user views the affected content, and only installations running the plugin version 'through 5.14.2' are affected. This is not a remote-unauthenticated flaw - the authentication requirement and required victim interaction meaningfully constrain real-world exploitability to sites that grant accounts to untrusted users.

This is a moderate-severity Stored XSS (CWE-79) in the Sonaar MP3 Audio Player WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent and point to a real-but-not-urgent issue: network vector and low complexity ease exploitation, but PR:L means the attacker must already hold an authenticated (low-privilege) account, and UI:R means a victim must load the affected page for the stored payload to fire. The scope change (S:C) reflects that injected script executes in other users'/visitors' browser context, elevating impact beyond the plugin itself. No EPSS score, CISA KEV listing, SSVC decision, or public POC is present in the supplied data, so there is no evidence of active exploitation or automatable mass-exploitation - this reads as a standard authenticated stored-XSS reported through Patchstack rather than a high-priority emergency. Note: the input provides no EPSS probability and no KEV status, so exploitation likelihood cannot be quantified from the data; prioritize based on whether untrusted or low-privilege authenticated users can reach the plugin's input fields.

A low-privileged authenticated user (e.g., a contributor or author) submits a crafted payload into an input field of the Sonaar MP3 Audio Player plugin that is stored without proper neutralization. When an administrator or site visitor later views the page rendering that content, the malicious JavaScript executes in their browser, enabling session/cookie theft or actions in their context. No public exploit code is identified at time of analysis.