MP3 Audio Player by Sonaar EUVD-2026-69925

The plugin must be installed and active on a WordPress site running version <= 5.13.1. The attacker must be able to supply input that the plugin stores or reflects without sanitization - this likely requires access to a public-facing form, endpoint, or media metadata field exposed by the plugin (exact input vector not specified in available data). A victim with an active browser session on the WordPress site must subsequently visit a page that renders the plugin's output containing the injected payload (UI:R). Exploitation is limited to triggering actions or stealing credentials within the victim's browser context; direct server-side code execution is not indicated. No authentication is required from the attacker side (PR:N), but successful impact depends on the victim being authenticated or having a valuable session.

The CVSS 7.1 score with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L accurately characterizes the risk profile. The low complexity and no-privilege-required attributes make this trivially exploitable from the network. The key limiting factor is UI:R - a victim (likely an authenticated WordPress administrator or logged-in user) must visit the page containing the injected payload, which is consistent with a stored XSS scenario where the payload lies dormant until triggered. Impact metrics are assessed as L/L/L (Low confidentiality, integrity, availability), which is standard for XSS in scope-changed contexts - session token theft or admin action hijacking is plausible but constrained to the browser session. No EPSS data was provided; no KEV listing exists; no POC has been publicly identified. The practical priority is medium: sites hosting audio/podcast content with public-facing submission forms or comment fields in the plugin are most exposed, but mass exploitation is unlikely without a published proof-of-concept.

An unauthenticated attacker identifies a WordPress site running Sonaar MP3 Audio Player <= 5.13.1 and submits a crafted payload (e.g., a malicious track title or metadata field) containing a JavaScript snippet through a public-facing input accepted by the plugin. When a logged-in WordPress administrator navigates to a page that renders the affected audio player output, the script executes in their browser, allowing the attacker to exfiltrate the admin's session cookie or perform privileged WordPress actions (such as creating a rogue admin account) via forged authenticated requests. No public proof-of-concept has been identified, but the attack is mechanically straightforward for any attacker familiar with WordPress plugin XSS patterns.