Mp3 Audio Player For Music Radio Podcast By Sonaar
Monthly
Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has documented the issue.
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Server-Side Request Forgery (SSRF) in Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin versions up to 5.11 allows unauthenticated remote attackers to forge requests to internal or external systems with high attack complexity, affecting confidentiality and integrity of data accessible from the server. EPSS scoring of 0.02% indicates minimal real-world exploitation probability despite moderate CVSS severity (5.4), and no active exploitation has been confirmed; patch availability status requires vendor verification.
Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has documented the issue.
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Server-Side Request Forgery (SSRF) in Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin versions up to 5.11 allows unauthenticated remote attackers to forge requests to internal or external systems with high attack complexity, affecting confidentiality and integrity of data accessible from the server. EPSS scoring of 0.02% indicates minimal real-world exploitation probability despite moderate CVSS severity (5.4), and no active exploitation has been confirmed; patch availability status requires vendor verification.