{"id":"CVE-2026-111967","kind":"vulnerability","aliases":["CVE-2026-111967"],"related":[],"title":"WordPress MP3 Audio Player plugin: shortcode attribute lets contributors run scripts","description":"The MP3 Audio Player  WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.","summary":"The MP3 Audio Player WordPress plugin before 5.16 outputs one shortcode attribute into HTML without escaping it. A contributor-level user can inject JavaScript that runs in the browser of another user, such as an administrator previewing a pending post.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["only-trusted-authors","plugin-5.16-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the MP3 Audio Player plugin in the WordPress admin plugins list; it is affected if it is below `5.16`.\n- Search post content for the plugin's audio player shortcode and look for unusual attribute values containing HTML or script tags.","fix":"- Update the MP3 Audio Player plugin to `5.16` or later.\n- Until updated, restrict Contributor-level and above accounts to trusted users.","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:32+00:00","updated_at":"2026-10-28T06:32:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MP3 Audio Player plugin to `5.16` or later.\n- Until updated, restrict Contributor-level and above accounts to trusted users.","reach":"network","title":"WordPress MP3 Audio Player plugin: shortcode attribute lets contributors run scripts","impact":"medium","summary":"The MP3 Audio Player WordPress plugin before 5.16 outputs one shortcode attribute into HTML without escaping it. A contributor-level user can inject JavaScript that runs in the browser of another user, such as an administrator previewing a pending post.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Injected script runs in an administrator's browser session on the site","analyst_note":"","how_to_check":"- Check the installed version of the MP3 Audio Player plugin in the WordPress admin plugins list; it is affected if it is below `5.16`.\n- Search post content for the plugin's audio player shortcode and look for unusual attribute values containing HTML or script tags.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-5.16-or-later","only-trusted-authors"],"who_is_affected":"Sites running the MP3 Audio Player WordPress plugin before 5.16 that allow Contributor-level or higher users to create content with its shortcode. Sites without the plugin, or where only trusted editors publish, face less exposure. The sources do not say whether a default configuration is needed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3320,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111967':14A,17A '-2026':13A,16A '5.16':33B,74C 'access':98C 'administr':62B,113C 'allow':92C 'anoth':57B,108C 'arbitrari':103C 'attribut':7A,37B,84C,91C 'audio':3A,28B,69C,81C 'browser':55B 'content':120C 'contributor':9A,45B,96C 'contributor-level':44B,95C 'cve':12A,15A 'escap':41B,77C 'execut':106C 'host':21B 'html':39B,90C 'inject':49B,102C 'javascript':50B,104C 'let':8A 'level':46B,97C 'mp3':2A,27B,68C 'one':35B,78C 'output':34B,86C 'packag':18B 'pend':65B,116C 'player':4A,29B,70C,82C 'plugin':5A,25B,31B,72C 'post':66B,117C 'preview':63B,114C 'run':10A,52B 'script':11A 'self':20B 'self-host':19B 'shortcod':6A,36B,83C 'user':47B,58B,93C,109C 'view':118C 'without':40B 'wordpress':1A,22B,24B,30B,71C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MP3 Audio Player WordPress plugin before 5.16 that allow Contributor-level or higher users to create content with its shortcode. Sites without the plugin, or where only trusted editors publish, face less exposure. The sources do not say whether a default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111967","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}