Sonaar MP3 Audio Player: Stored XSS and Administrative Account Creation (CVE-2026-111967)
A stored XSS vulnerability in the Sonaar MP3 Audio Player WordPress plugin allows attackers to trigger administrative account creation by injecting malicious scripts that execute when viewed by an administrator.
CVE search metadata
CVE search record: CVE-2026-111967. Severity: medium. CVSS: 6.8. EPSS: 0.32%. KEV: no. Product: MP3 Audio Player (<= 5.14). Brief: Sonaar MP3 Audio Player: Stored XSS and Administrative Account Creation (CVE-2026-111967). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-111967-stored-xss/
Triage facts
Revision 1- Applicability
- MP3 Audio Player (<= 5.14)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 8, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
The Sonaar MP3 Audio Player WordPress plugin, versions 5.14 and below, contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-111967). This flaw allows unauthorized parties to inject malicious scripts into the application. When a site administrator views the affected component, the injected script can execute, leading to the unauthorized creation of administrative accounts. A proof-of-concept exploit is currently available.
Impact
Successful exploitation allows for the creation of unauthorized administrative accounts, potentially leading to full site compromise, unauthorized data access, and persistent control over the WordPress instance.
Recommendation
- Inventory all WordPress sites running the Sonaar MP3 Audio Player plugin.
- Disable or remove the MP3 Audio Player plugin if an update to a version beyond 5.14 is not immediately available.
- Review WordPress user lists for unauthorized administrator accounts created since the plugin was installed.
- Monitor administrative audit logs for unusual account creation events.
Immediate actions
Inventory and disable Sonaar MP3 Audio Player version 5.14 or lower
Threat Hunt
Identify unauthorized administrative accounts created in WordPress
Data: WordPress user database logs, Audit logs for user creation
Mitigations
Patch MP3 Audio Player to 5.16 or later
CVE-2026-111967