CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.
Explanation of Vulnerability in Simple Terms
The Sonaar Music Plugin contains a cross-site scripting (XSS) vulnerability in version 4.7. An attacker with low-level access can inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction to trigger. Update to a version newer than 4.7.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers and steals their session data or credentials.
Potential impact on your site
Users' accounts and data are at risk if attackers with basic access inject malicious content into your site.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must visit or interact with a page containing the injected script.
Key dates
External resources
Related vulnerabilities
