Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-60062 EUVD-2025-204123GHSA-jpxr-92fj-3jrp

WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability

Published Dec 18, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.

Affected products

VendorProductAffectedFixed
mmetrodw tPlayer ≤ 1.2.1.6 —

References