CVE-2026-111967— MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute

Quick assessment

Affected

Unknown MP3 Audio Player

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 5.16 版本之前的 MP3 Audio Player WordPress 插件中，其音频播放器短代码的某个属性在输出到 HTML 属性前未进行转义处理。这使得拥有“贡献者”级别及以上权限的用户能够注入任意 JavaScript 代码；当其他用户（例如正在预览待发布文章的管理员）查看该内容时，这些脚本将被执行。

AI Predicted 6.5 Difficulty: Easy Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1059 · Command and Scripting Interpreter

Updated Oct 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute

Source: CVE Program / CVE List V5

Vulnerability Description

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	MP3 Audio Player	5.9 ~ 5.16	-

II. Public POCs for CVE-2026-111967

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111967

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-111967

Same Patch Batch · Unknown · 2026-10-28 · 42 CVEs total

CVE-2026-110508	5.3 MEDIUM	Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypas
CVE-2026-106648	5.3 MEDIUM	Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vi
CVE-2026-103330	5.3 MEDIUM	Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature
CVE-2026-103313	5.3 MEDIUM	BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Retur
CVE-2026-115223	4.9 MEDIUM	Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-110524		Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode
CVE-2026-103331		UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via
CVE-2026-110509		Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via
CVE-2026-107100		Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclos
CVE-2026-110506		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
CVE-2026-110292		PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Can
CVE-2026-110507		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop
CVE-2026-106002		Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
CVE-2026-106003		Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
CVE-2026-106647		Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget
CVE-2026-107098		Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widge
CVE-2026-107097		Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection vi
CVE-2026-103382		Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confi
CVE-2026-103688		Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVE-2026-105972		WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribu

Showing top 20 of 42 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown