What’s Vulnerable › Products

sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar version is affected

Latest sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerabilities

• CVE-2026-16776 — MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
• CVE-2026-104673 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-81289 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-65506 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-39647 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4)
• CVE-2026-1219 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 5.3)
• CVE-2026-1249 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery (CVSS 5.0)
• CVE-2025-32235 — WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2024-13157 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed (CVSS 6.4)
• CVE-2024-56266 — WordPress MP3 Audio Player plugin <= 5.8 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2023-47822 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-10268 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode (CVSS 5.4)
• CVE-2024-7856 — MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
• CVE-2024-5664 — MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode (CVSS 5.4)
• CVE-2024-31343 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerability (CVSS 7.5)
• CVE-2024-30530 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-30487 — WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerability (CVSS 7.6)
• CVE-2021-24624 — MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting (CVSS 4.8)