MP3 Audio Player (<= 5.14) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mp3-audio-player--5.14/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 22:08:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSonaar MP3 Audio Player: Stored XSS and Administrative Account Creation (CVE-2026-111967)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-111967-stored-xss/Sun, 08 Nov 2026 22:08:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-111967-stored-xss/A stored XSS vulnerability in the Sonaar MP3 Audio Player WordPress plugin allows attackers to trigger administrative account creation by injecting malicious scripts that execute when viewed by an administrator.The Sonaar MP3 Audio Player WordPress plugin, versions 5.14 and below, contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-111967). This flaw allows unauthorized parties to inject malicious scripts into the application. When a site administrator views the affected component, the injected script can execute, leading to the unauthorized creation of administrative accounts. A proof-of-concept exploit is currently available.

Impact

Successful exploitation allows for the creation of unauthorized administrative accounts, potentially leading to full site compromise, unauthorized data access, and persistent control over the WordPress instance.

Recommendation

  • Inventory all WordPress sites running the Sonaar MP3 Audio Player plugin.
  • Disable or remove the MP3 Audio Player plugin if an update to a version beyond 5.14 is not immediately available.
  • Review WordPress user lists for unauthorized administrator accounts created since the plugin was installed.
  • Monitor administrative audit logs for unusual account creation events.
]]>lowadvisory