EUVD-2026-66941
GHSA-q364-8ggx-vgvp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible unauthenticated XSS; UI:R reflects mandatory victim interaction; A:N assigned as XSS does not produce meaningful availability impact absent additional evidence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
AnalysisAI
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Music Player for WooCommerce plugin must be installed, active, and running version 1.8.9 or earlier on a WordPress/WooCommerce site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable flaw requiring no authentication but dependent on victim interaction (UI:R), which substantially moderates real-world exploitability compared to fully automated or wormable scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WooCommerce store running Music Player for WooCommerce version 1.8.9 or earlier, then crafts a URL embedding a malicious JavaScript payload within a vulnerable plugin parameter. The attacker delivers the link via a targeted phishing email to a store administrator; when the administrator clicks the link and the page renders in their browser, the payload executes and exfiltrates the WordPress authentication cookie, granting the attacker administrative access to the store. … |
| Remediation | Patch available per vendor advisory - update the Music Player for WooCommerce plugin to the version released after 1.8.9 via the WordPress dashboard (Plugins > Installed Plugins > Update Available); the exact patched release version is not confirmed in the available intelligence data and must be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocommerce-plugin-1-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve or the official WordPress plugin repository changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WooCommerce installations running Music Player for Codepeople plugin version 1.8.9 or earlier and immediately disable or remove the plugin to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today