CVE-2022-4542

The CVE-2022-4542 issue affects the Compact WP Audio Player WordPress plugin prior to version 1.9.8. It arises from not validating and escaping certain shortcode attributes before output, allowing a user with as little as Contributor privileges to perform Stored XSS against higher-privilege users...

CVE-2022-4542 Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

CVE-2022-4542 Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

WordPress plugin Compact WP Audio Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers. relevant is a relevant content display plugin used in it. wordpress plugin is an...

PT-2023-14663 · WordPress · Compact Wp Audio Player

Name of the Vulnerable Software and Affected Versions: Compact WP Audio Player WordPress plugin versions prior to 1.9.8 Description: The issue concerns the Compact WP Audio Player WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them. Th...

WordPress Compact WP Audio Player plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress Compact WP Audio Player plugin in versions prior to 1.9.7, which stems from the fact that the web application does not adequatel...

CVE-2021-24735

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack...

CVE-2021-24735

The CVE-2021-24735 entry concerns the WordPress plugin Compact WP Audio Player (pre-1.9.7). Connected sources corroborate a CSRF vulnerability caused by missing nonce checks, enabling an attacker with a logged‑in admin session to change the Disable Simultaneous Play setting. Affected version rang...

CVE-2021-24734

The CVE-2021-24734 entry affects the WordPress Compact WP Audio Player plugin (versions prior to 1.9.7). The root cause is insufficient escaping of shortcodes attributes, enabling Stored XSS by users with as low as Contributor. Impact is client-side JavaScript execution in affected pages. Remedia...

CVE-2021-24734 Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

WordPress Compact WP Audio Player plugin <= 1.9.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Compact WP Audio Player plugin versions = 1.9.6. Solution Update the WordPress Compact WP Audio Player plugin to the latest available version at least 1.9.7...

WordPress Compact WP Audio Player plugin <= 1.9.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress Compact WP Audio Player plugin versions = 1.9.6. Solution Update the WordPress Compact WP Audio Player plugin to the latest available version at least 1.9.7...