{"id":"CVE-2021-24624","aliases":["EUVD-2021-11536","GHSA-x85m-5xj6-fj3p"],"status":"published","title":"MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c 2.4.2 - Multiple Admin+ Cross Site Scripting","description":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00643,"percentile":0.51271,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-11-01T08:46:03Z","modified":"2026-06-17T03:40:20Z","products":[{"vendor":"sonaar","product":"mp3 audio player for music, radio \u0026 podcast by sonaar"},{"vendor":"sonaar","product":"mp3_audio_player_for_music\\,_radio_\\\u0026_podcast"},{"vendor":"unknown","product":"mp3 audio player for music, radio \u0026 podcast by sonaar"}],"references":[{"url":"https://wpscan.com/vulnerability/d79d2f6a-257a-4c9e-b971-9837abd4211c","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24624"},{"url":"https://github.com/advisories/GHSA-x85m-5xj6-fj3p"}],"sources":{"cve":[{"id":"CVE-2021-24624","title":"MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c 2.4.2 - Multiple Admin+ Cross Site Scripting","description":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks","status":"published","published":"2021-11-01T08:46:03Z","modified":"2024-08-03T19:35:20.275Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11536","description":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks","status":"published","published":"2021-11-01T08:46:03Z","modified":"2024-08-03T19:35:20Z","updated_at":"2026-11-03T03:24:56.857735Z"}],"ghsa":[{"id":"GHSA-x85m-5xj6-fj3p","title":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not...","description":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks","status":"published","published":"2022-05-24T19:19:20Z","modified":"2023-01-30T05:03:32Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:51.429276Z"}],"nvd":[{"id":"CVE-2021-24624","description":"The MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks","status":"published","published":"2021-11-01T09:15:08.617Z","modified":"2026-06-17T03:40:20.877Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:00.549994Z"}]}}