Mp3 Audio Player Music Player Podcast Player Radio By Sonaar
Monthly
Stored cross-site scripting in the Sonaar MP3 Audio Player - Music Player, Podcast Player & Radio plugin for WordPress (all versions up to and including 5.14.2) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript through the plugin's shortcode attributes, which then executes in the browser of any user who later loads the affected page. The payload survives WordPress's save-time wp_kses_post sanitization because it is carried in a shortcode attribute rather than raw post HTML, so the unescaped value reaches render time intact. The flaw is authentication-gated and rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; there is no CISA KEV listing for this CVE.
Stored cross-site scripting in the Sonaar MP3 Audio Player - Music Player, Podcast Player & Radio plugin for WordPress (all versions up to and including 5.14.2) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript through the plugin's shortcode attributes, which then executes in the browser of any user who later loads the affected page. The payload survives WordPress's save-time wp_kses_post sanitization because it is carried in a shortcode attribute rather than raw post HTML, so the unescaped value reaches render time intact. The flaw is authentication-gated and rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; there is no CISA KEV listing for this CVE.