CVE-2018-6001

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-01-22 · updated 2026-06-17
Weakness: CWE-79

Description

The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).

Affected products

Webartisan Soundy Audio Playlist: through 4.6

References

http://www.defensecode.com/advisories/DC-2018-01-002_WordPress_Soundy_Audio_Playlist_Plugin_Advisory.pdf
http://www.defensecode.com/advisories/DC-2018-01-002_WordPress_Soundy_Audio_Playlist_Plugin_Advisory.pdf

Get alerted when CVE-2018-6001 or the next vulnerability affects your stack