Lbg Audio2 Html5 Vulnerabilities & Security Issues

Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Reflected Cross-Site Scripting

medium

The Responsive HTML5 Audio Player PRO With Playlist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:: 6.1
Affected:: up to 3.5.8
Fixed in:: 3.5.9
Disclosed:: Jul 23, 2025

CVE-2025-54056 on NVD →

Responsive HTML5 Audio Player PRO With Playlist <= 3.5.7 - Authenticated (Contributor+) SQL Injection

medium

The Responsive HTML5 Audio Player PRO With Playlist plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, w...

CVSS:: 6.5
Affected:: up to 3.5.7
Fix:: No patched version reported
Disclosed:: May 16, 2025

CVE-2025-32287 on NVD →

Responsive HTML5 Audio Player PRO [lbg-audio2-html5] <= 3.5.7 (unfixed)

unknown

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist allows SQL Injection. This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through 3.5.7.

Affected:: up to 3.5.7
Fix:: No patched version reported
Disclosed:: May 16, 2025