UNKNOWN NVD

CVE-2026-111967

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, all

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

References

https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c/

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This unknown severity vulnerability was published on 2026-10-28 via NVD.

vulnfeed aggregates 14962 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.