CVE-2021-24624: MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-01 · updated 2026-06-17
Weakness: CWE-79

Description

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks

Affected products

sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: before 2.4.2 — fixed in 2.4.2

How to fix

Upgrade to a fixed version: sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 2.4.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24624 or the next vulnerability affects your stack