Vulnerabilities

TI-2024-12404 CVE-2024-13362 · GHSA-c7cj-88jr-mhx2

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

LOW 27

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-05-01 No fix listed CWE-79

TI-2025-04795 CVE-2025-5340 · GHSA-cv4p-gxqj-fq6g

Cross-site scripting in smartwpress Music Player for Elementor – Audio Player & Podcast…

LOW 28

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00301 Published 2025-06-03 No fix listed CWE-79

TI-2025-23288 CVE-2025-32190 · GHSA-5fmm-w9xf-8f6h

WordPress Musician's Pack For Elementor plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartwpress Musician's Pack For Elementor music-pack-for-elementor allows DOM-Based XSS.This issue affects Musician's…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00407 Published 2025-04-04 No fix listed CWE-79

TI-2024-09804 CVE-2024-10582 · GHSA-5j52-m6jh-ch5g

Missing authorization in smartwpress Music Player for Elementor – Audio Player & Podcast…

LOW 20

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versi…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00333 Published 2024-11-15 No fix listed CWE-862

TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7

Freemius SDK <= 2.4.2 - Missing Authorization Checks