Description
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Html5 Audio Player | < 2.1.12 | 2.1.12 |
References
- https://wpscan.com/vulnerability/19ee5e33-acc8-40c5-8f54-c9cb0fa491f0 exploit vdb-entry technical-description