CVE-2026-111967 — MEDIUM (6.8)

Vulnerability Description

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c/

FAQ

What is CVE-2026-111967?

CVE-2026-111967 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level acces...

How severe is CVE-2026-111967?

CVE-2026-111967 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-111967?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.