Description

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T10:16:37.883Z",
  "pubdate": "2026-08-27T10:16:37.883Z",
  "executiveSummary": "The Music Player for WooCommerce plugin for WordPress, in versions 1.8.9 and below, is susceptible to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.\nThis security flaw arises due to the improper sanitization and validation of user-supplied input before rendering it within the web application's response.\nThe vulnerability allows unauthenticated remote attackers to inject malicious client-side scripts into web pages viewed by other users, including administrators.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, such as session hijacking, account takeover, unauthorized data modification, or the redirection of users to malicious external domains.\nThe risk to the integrity and confidentiality of the WordPress installation is significant, as the vulnerability does not require authentication, widening the attack surface to any network-connected actor.\nOrganizations utilizing this plugin are encouraged to restrict its use until a patched version is deployed or to implement strict input validation mechanisms at the Web Application Firewall (WAF) level to block malicious payloads targeting known injection vectors.",
  "technicalDetails": "The vulnerability is a classic Cross-Site Scripting (XSS) flaw localized within the request handling mechanism of the Music Player for WooCommerce plugin. The root cause is the failure of the application to properly sanitize, filter, or escape input parameters passed through HTTP GET requests before they are reflected back to the client's browser.\nIn versions 1.8.9 and below, the plugin does not adequately implement output encoding for specific input fields processed during the generation of the player interface. Because the plugin reflects these inputs without adequate security context, an attacker can supply a specially crafted URL containing malicious JavaScript payloads.\nThe attack flow begins when an unauthenticated attacker identifies a vulnerable parameter within the plugin's front-end interface. The attacker then crafts a URL incorporating an XSS payload—often encapsulated within the script tags or event handlers—designed to execute when a victim navigates to the manipulated link.\nOnce the victim's browser processes the response from the server, the unsanitized input is rendered directly into the HTML Document Object Model (DOM). This allows the injected script to execute within the context of the user's session. The execution of the malicious script enables the attacker to access sensitive information, including document cookies (if not protected by HttpOnly flags), local storage, and session tokens.\nFurthermore, the attacker can leverage this execution flow to perform actions in the victim's name, such as changing administrative passwords, modifying plugin settings, or injecting further malicious content into the site, such as persistent backdoors. The vulnerability is categorized as Reflected XSS because the payload is reflected from the web server to the victim's browser as part of a single request-response cycle, typically initiated via phishing or direct link distribution.\nThe scope of impact is critical for sites where privileged users, such as administrators, frequently interact with the site's front-end, as the execution of high-privilege scripts can result in a full site compromise through the administrative dashboard."
}