High · 7.1 CVE-2026-78283 EUVD-2026-66941GHSA-q364-8ggx-vgvp

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Published Aug 27, 2026 · Updated Aug 27, 2026 · Assigned by Patchstack

Vendor: codepeople Product: Music Player for WooCommerce Category: Web / CMS

Description

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Affected products

Vendor	Product	Affected	Fixed
codepeople	Music Player for WooCommerce	≤ 1.8.9	—

References

https://patchstack.com/database/wordpress/plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocommerce-plugin-1-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry