EUVD-2026-69925
GHSA-c2mm-3m3r-hgg8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS with unauthenticated injection and scope change into victim browser; A:N because XSS does not cause meaningful availability impact beyond transient session disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
AnalysisAI
Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin must be installed and active on a WordPress site running version <= 5.13.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L accurately characterizes the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin to the version released after 5.13.1 - check the WordPress plugin repository or Patchstack advisory at the reference URL for the exact fixed release version, as the input data does not specify it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify the Sonaar plugin version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery (SSRF) in Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin versions up to
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and e
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today