---
id: "CVE-2026-111967"
kind: "vulnerability"
aliases: ["CVE-2026-111967"]
title: "WordPress MP3 Audio Player plugin: shortcode attribute lets contributors run scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["only-trusted-authors", "plugin-5.16-or-later", "plugin-not-installed"]
published_at: "2026-10-28T06:16:34+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111967", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# WordPress MP3 Audio Player plugin: shortcode attribute lets contributors run scripts

The MP3 Audio Player WordPress plugin before 5.16 outputs one shortcode attribute into HTML without escaping it. A contributor-level user can inject JavaScript that runs in the browser of another user, such as an administrator previewing a pending post.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the MP3 Audio Player plugin in the WordPress admin plugins list; it is affected if it is below `5.16`.
- Search post content for the plugin's audio player shortcode and look for unusual attribute values containing HTML or script tags.

## Fix

- Update the MP3 Audio Player plugin to `5.16` or later.
- Until updated, restrict Contributor-level and above accounts to trusted users.

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111967

## From the sources

The MP3 Audio Player  WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_