Vulnerability · Published Oct 28, 2026 · Assigned by WPScan
CVE-2026-111967MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
Medium 6.8
In plain English
A medium-severity cross-site scripting in MP3 Audio Player from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 75.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MP3 Audio Player | 5.9 – before 5.16 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c/ exploit, vdb-entry, technical-description