Stored Cross-Site Scripting in Sonaar's MP3 Audio Player Plugin for WordPress

CVE-2024-13157

What is CVE-2024-13157?

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress contains a vulnerability that allows for stored cross-site scripting through the Podcast RSS Feed. This flaw arises from inadequate input sanitization and output escaping for user-provided attributes. Authenticated attackers with contributor access or higher can exploit this vulnerability to inject sinister web scripts into pages. The malicious scripts can execute whenever a user visits an affected page, potentially leading to data theft or site compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References