CVE-2023-0170

The CVE-2023-0170 entry documents an XSS vulnerability in the WordPress Html5 Audio Player plugin prior to version 2.1.12. The issue arises because the plugin does not validate and escape certain shortcode attributes before embedding them in pages/posts, enabling users with the Contributor role o...

CVE-2024-37445

CVE-2024-37445 is a stored XSS vulnerability in the WordPress plugin WordPress HTML5 Audio Player (bPlugins Html5 Audio Player), affected up to version 2.2.23. The issue arises from improper neutralization during web page generation, enabling stored cross-site scripting. The Wordfence/WordPress v...

CVE-2021-24412

The CVE-2021-24412 entry applies to the WordPress plugin Html5 Audio Player (before 2.1.3). The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/validation of shortcode parameters, enabling users with as low as a contributor role to inject malicious pa...