Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: mra13 Component: Compact Wp Audio Player Clear all filters
TI-2022-04146 CVE-2022-4542 · GHSA-v234-jrgr-8q98

Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

Priority HIGH 66

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor t…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 1.9.8
TI-2021-07017 CVE-2021-24735 · GHSA-c8jp-pc3c-h742

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

Priority LOW 30

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 1.9.7 CWE-352
TI-2021-07016 CVE-2021-24734 · GHSA-mc96-xvr9-9pqc

Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 1.9.7 CWE-79