Html5 Audio Player Vulnerabilities

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 2.2.27

Fixed in:

2.5.1

Disclosed:

Apr 30, 2026

CVE-2024-13362 on NVD →

The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary loc...

CVSS:

7.2

Affected:

2.4.0 – 2.5.1

Fixed in:

2.5.2

Disclosed:

Dec 18, 2025

CVE-2025-13999 on NVD →

The Html5 Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 2.2.28

Fixed in:

2.3.0

Disclosed:

Apr 16, 2025

CVE-2025-39524 on NVD →

The Html5 Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 2.2.23

Fixed in:

2.2.24

Disclosed:

Jun 28, 2024

CVE-2024-37445 on NVD →

The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica...

CVSS:

6.4

Affected:

up to 2.2.19

Fixed in:

2.2.22

Disclosed:

May 9, 2024

CVE-2024-4398 on NVD →

The Html5 Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level...

CVSS:

6.4

Affected:

up to 2.1.11

Fixed in:

2.1.12

Disclosed:

Jan 12, 2023

CVE-2023-0170 on NVD →

The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

CVSS:

6.4

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Sep 20, 2021

CVE-2021-24412 on NVD →