Music Player for WooCommerce CVE-2026-78283

The Music Player for WooCommerce plugin must be installed, active, and running version 1.8.9 or earlier on a WordPress/WooCommerce site. Exploitation requires a victim - either a store customer or administrator - to load the attacker-crafted URL or XSS-injected page in their browser (UI:R per CVSS vector); the attacker cannot trigger exploitation autonomously without some form of social engineering or a stored payload on a page the victim naturally visits. No authentication is required from the attacker (PR:N). Exploitation impact is bounded by the victim's privilege level: if a customer account is targeted, impact is limited to that session; if an administrator is targeted, the impact may extend to full store compromise. No additional non-default configuration requirements are confirmed from the available data.

The CVSS base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable flaw requiring no authentication but dependent on victim interaction (UI:R), which substantially moderates real-world exploitability compared to fully automated or wormable scenarios. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be independently confirmed. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept code has been identified, indicating exploitation has not been observed at scale. The A:L (availability impact) component in the provided CVSS vector is atypical for XSS and is not independently supported by the description; independent assessment places availability impact at A:N. Real-world risk is moderate for stores with authenticated administrator sessions that could be hijacked via social engineering, particularly given WooCommerce's prevalence in retail e-commerce environments where admin-targeted phishing is a known attack pattern.

An attacker identifies a WooCommerce store running Music Player for WooCommerce version 1.8.9 or earlier, then crafts a URL embedding a malicious JavaScript payload within a vulnerable plugin parameter. The attacker delivers the link via a targeted phishing email to a store administrator; when the administrator clicks the link and the page renders in their browser, the payload executes and exfiltrates the WordPress authentication cookie, granting the attacker administrative access to the store. No public exploit code has been identified at time of analysis, but the low complexity and unauthenticated nature of the flaw lower the barrier for independent rediscovery.