Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Compact WP Audio Player 1.9.7 Clear all filters
TI-2021-07017 CVE-2021-24735 · GHSA-c8jp-pc3c-h742

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

Priority LOW 30

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 1.9.7 CWE-352
TI-2021-07016 CVE-2021-24734 · GHSA-mc96-xvr9-9pqc

Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 1.9.7 CWE-79