Description

Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:12.657Z",
  "pubdate": "2026-09-02T12:17:12.657Z",
  "executiveSummary": "The MP3 Audio Player for Music, Radio & Podcast by Sonaar, in versions 5.13.1 and below, is susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript code within the context of a victim's browser session.\nThe flaw stems from improper input sanitization of user-supplied data before it is rendered in the web interface.\nSuccessful exploitation can result in unauthorized actions being performed on behalf of authenticated users, session hijacking, credential theft, and the defacement of the affected WordPress site.\nGiven that the vulnerability does not require authentication, it poses a significant risk to the integrity and confidentiality of the user experience and administrative operations of the host platform.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) issue within the Sonaar MP3 Audio Player plugin. It exists because the plugin fails to adequately sanitize, validate, or encode specific URL parameters or user-input fields before reflecting them in the HTML output generated for the end-user.\nThe root cause lies in the application's handling of HTTP GET or POST request parameters that are dynamically rendered into the DOM without sufficient output encoding. By crafting a malicious URL containing a JavaScript payload, an attacker can trick a target user—including high-privileged administrators—into clicking a link that triggers the execution of the payload in the victim's browser.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious request containing a crafted payload (e.g., <script>alert(document.cookie)</script>) directed at a vulnerable endpoint of the Sonaar plugin. Second, when an unsuspecting user visits the crafted URL, the server processes the input and reflects the malicious script directly into the page source. Third, the victim's browser, receiving the malformed response, fails to distinguish the attacker-supplied code from legitimate script content and executes the payload within the context of the vulnerable site's origin.\nBecause the vulnerability is unauthenticated, no prior access or interaction with the site's backend is required, widening the attack surface to any visitor of the site. The payload executes with the privileges of the victim’s session. If the victim is an administrator, the attacker can perform arbitrary administrative actions, such as creating new rogue accounts, modifying plugin settings, or injecting persistent malicious content into the site via the dashboard. Furthermore, the attacker can intercept sensitive cookies or session tokens, facilitating full account takeover.\nThe vulnerable component is the rendering logic of the Sonaar MP3 Audio Player, specifically where input variables are echo'd directly to the user interface. Affected versions include all iterations up to and including 5.13.1. The vulnerability is network-exploitable and does not require elevated privileges, making it a critical threat to WordPress installations running the affected plugin versions."
}