MP3 Audio Player CVE-2026-111967

Exploitation requires an authenticated WordPress account with Contributor-level privileges or higher on a site running MP3 Audio Player between version 5.9 and before 5.16. The attacker injects JavaScript into one of the plugin's audio player shortcode attributes, which the plugin outputs into an HTML attribute without escaping. Crucially, the payload does not fire on its own: it executes only when another, typically higher-privileged user - the description names an administrator previewing a pending post - views the attacker's content (UI:R). Limiting factors are therefore: a valid contributor (or higher) account is mandatory, the plugin must be the affected version with the audio player shortcode in use, and a victim such as an admin must actually open/preview the malicious content. These constraints make opportunistic mass exploitation unlikely and align with the low EPSS score.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in the MP3 Audio Player WordPress plugin, and the signals consistently point to a measured rather than urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) is internally inconsistent with the description and should be treated with caution: the description states exploitation requires only Contributor-level access (a LOW-privilege authenticated role), which contradicts PR:H, and the C:H/I:H/A:H impact rating is unusually high for a shortcode-attribute XSS that WPScan-class advisories typically score as low confidentiality/integrity impact. The vulnerability also depends on UI:R - a separate higher-privileged user (an admin previewing a pending post) must view the injected content - which meaningfully constrains attacker control over timing. EPSS is low at 0.17% (6th percentile), there is NO CISA KEV listing, and no public exploit was identified in the input, all of which argue against widespread or automated exploitation. The vuln.today decision label is 'this_month', indicating it should be remediated on a normal patch cadence, not as an emergency. Net assessment: a genuine privilege-escalation-flavored XSS worth patching because it lets a low-trust contributor attack an administrator, but not a high-real-risk, actively-exploited issue - the elevated CVSS impact metrics appear inflated relative to the described mechanism and should be verified against the WPScan advisory.

A low-trust Contributor account submits a pending post containing the plugin's audio player shortcode with a malicious payload in the vulnerable attribute, which is written unescaped into an HTML attribute. When an administrator later previews that pending post for moderation, the injected JavaScript executes in the admin's authenticated browser session, potentially enabling account takeover or site configuration changes. No public exploit code was identified in the available data, and successful exploitation hinges on an administrator actually viewing the attacker-controlled content.