CVE-2021-24412

CVE-2021-24412: Html5 Audio Player < 2.1.3 - Contributor+ Stored Cross-Site Scripting

Vendor Unknown
Product Html5 Audio Player – Audio Player for WordPress
Weakness CWE-79 · XSS
Published October 18, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

Key dates

02Disclosure timeline

October 18, 2021 CVE published
August 3, 2024 Record updated