Live › vulnerability › CVE-2026-111967
Go to dashboardThe MP3 Audio Player WordPress plugin before 5.16 outputs one shortcode attribute into HTML without escaping it. A contributor-level user can inject JavaScript that runs in the browser of another user, such as an administrator previewing a pending post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the MP3 Audio Player WordPress plugin before 5.16 that allow Contributor-level or higher users to create content with its shortcode. Sites without the plugin, or where only trusted editors publish, face less exposure. The sources do not say whether a default configuration is needed.
No product ranges from the sources yet.
5.16.5.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
This page as .md · .json · in your agent: get_signal("CVE-2026-111967")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.