Music Player For Woocommerce
Monthly
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.