Description
WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonaar | Sonaar Music Plugin | 4.7 | — |
References
- ExploitDB-51739 exploit
- VulnCheck Advisory: WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments third-party-advisory