CVE-2026-111967: MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with Contributor-level access or higher can exploit it by placing a malicious value in an affected audio player shortcode attribute. The payload executes when another user views the content, including an administrator previewing a pending post.
Which versions are affected?
Versions before 5.16 are affected. The reported vulnerable range specifically includes versions 5.9 through 5.15.
What should administrators do if they cannot update immediately?
The available information identifies Contributor-level and higher accounts as the relevant attacker prerequisite. Restrict or review shortcode creation and pending-post previews from those accounts until the plugin can be updated.