WordPress Music Player for Elementor plugin <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via albumbuyurl Parameter vulnerability discovered by Webbernaut in WordPress Plugin Music Player for Elementor – Audio Player & Podcast Player versions = 2.4.6...

CVE-2025-5340

creationtimestamp| type| source ---|---|--- 2025-06-03 12:14:26+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpb7nuszad2 2025-06-03 16:04:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqpo6lch772a...

CVE-2025-5340 Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘albumbuyurl’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5340

CVE-2025-5340 : The Music Player for Elementor plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability via the album_buy_url parameter in all versions up to and including 2.4.6. Exploitation requires authenticated access at Contributor level or higher , enabling an a...