MP3 Audio Player EUVD-2026-96093

Requires an authenticated account with contributor-level capability or higher on the target WordPress site AND the Sonaar MP3 Audio Player plugin (version ≤5.14.2) installed and active. The specific trigger is injecting a malicious value into a shortcode ATTRIBUTE of the plugin's player shortcode - not raw post HTML - which is why WordPress's default wp_kses_post save-time sanitization fails to neutralize it. LIMITING FACTORS: the contributor-access requirement means it is not exploitable by anonymous visitors; sites that do not grant contributor/author roles to untrusted users, or that disable the plugin's shortcode, are not practically exposed. Execution occurs only when another user subsequently loads the page containing the injected shortcode.

This is a moderate, authentication-gated stored XSS (CVSS 6.4, CWE-79) with a CVSS:3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, but requiring PR:L (contributor-level account), which materially raises the bar versus an unauthenticated flaw. The scope change (S:C) and C:L/I:L reflect script execution in other users' browser contexts rather than direct server compromise. Exploitation status: no public exploit identified at time of analysis - the input provides no KEV listing, no POC flag, and no EPSS score, so real-world exploitation probability cannot be quantified from the data given. Reported by Wordfence, this is a credible but lower-tier priority: the contributor-access prerequisite means it is most relevant to multi-author WordPress sites where lower-trust users can author content, and it is not a drive-by unauthenticated vulnerability. MISSING DATA: EPSS and POC status are absent (not provided), and KEV is not listed; treat the absence as 'unknown', not 'safe'. The CVSS vector and description are internally consistent (network-delivered shortcode attribute, authenticated contributor, persistent payload), so no vector/description conflict is present.

On a WordPress site that allows contributor-level or higher authors, a malicious or compromised contributor embeds a Sonaar MP3 player shortcode and places a malicious script inside one of its attributes; because the payload is delivered via shortcode attributes rather than raw post HTML, WordPress's save-time wp_kses_post sanitization does not strip it. The unescaped attribute survives to render time, so the script executes in the browser of any user - including administrators - who later views the injected page, enabling session/cookie theft or admin-context actions. No public exploit code is identified at time of analysis, though the vulnerable code paths are documented in the referenced plugin source.