Server-Side Request Forgery Vulnerability in HTML5 Audio Player Plugin for WordPress
CVE-2025-13999

7.2HIGH

Key Information:

Vendor

WordPress
Status
Html5 Audio Player – The Ultimate No-code Podcast, Mp3 & Audio Player
Vendor
CVE Published:
19 December 2025

What is CVE-2025-13999?

The HTML5 Audio Player plugin for WordPress, specifically versions 2.4.0 through 2.5.1, contains a Server-Side Request Forgery vulnerability that exposes the application to unauthorized web requests. This issue occurs in the getIcyMetadata() function, enabling unauthenticated attackers to initiate requests to arbitrary internal services, potentially leading to data exposure or modification. Website owners utilizing this plugin should take immediate action to mitigate risks by updating to the latest version.

Affected Version(s)

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 <= 2.5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?old=3394789&...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenneth Dunn
JSON
.
CVE-2025-13999 : Server-Side Request Forgery Vulnerability in HTML5 Audio Player Plugin for WordPress