MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting
CVE-2021-24624

4.8MEDIUM

Key Information:

Vendor

Wordpress
Status
Mp3 Audio Player For Music, Radio & Podcast By Sonaar
Vendor
CVE Published:
1 November 2021

What is CVE-2021-24624?

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks

Affected Version(s)

MP3 Audio Player for Music, Radio & Podcast by Sonaar 2.4.2

References

https://wpscan.com/vulnerability/d79d2f6a-257a-4c9e-b971-...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.