Skip to content
OpenAdvisories

Vendor

smartwpress

3 known vulnerabilities.

Products

Music Player for Elementor – Audio Player & Podcast Player 2 Musician's Pack For Elementor 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2025-5340

    Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter

    The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible f…

    smartwpress Music Player for Elementor – Audio Player & Podcast Player Web / CMS
  • Medium 6.5
    CVE-2025-32190

    WordPress Musician's Pack For Elementor plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartwpress Musician's Pack For Elementor music-pack-for-elementor allows DOM-Based XSS.This issue affects Musician's Pack For Elementor: from n/a through <=…

    smartwpress Musician's Pack For Elementor
  • Medium 4.3
    CVE-2024-10582

    Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import

    The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This m…

    smartwpress Music Player for Elementor – Audio Player & Podcast Player Web / CMS