medium6.8
CVE-2026-111967
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, all…
Impact
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
Affected products
| Product | Affected versions |
|---|---|
| MP3 Audio Player WordPress Plugin | before 5.16 |
Versions were read from the advisory text. No structured product data has been published for this record yet.