EUVD-2026-89826

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93624

The Music Player for WooCommerce plugin for WordPress (versions

CVE-2026-101036

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-101036

A path traversal vulnerability exists in FLB-Music FLB-Music-Player versions 1.1.8, 1.1.9, 1.2.0, and 1.2.1 . The flaw originates from the path.join function within the file /src/main/core/createParsedTrack.ts . This vulnerability requires local access to exploit. While the exploit has been discl...

EUVD-2026-88198

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-101036 FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-101036: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283

CVE-2026-78283 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Music Player for WooCommerce , affecting versions ≤ 1.8.9 . The flaw was discovered by daroo and is scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ...

PT-2026-82460

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.12...

CVE-2026-49128

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...