CVE-2015-9420

Name of the Vulnerable Software and Affected Versions soundcloud-is-gold plugin versions prior to 2.3.2

Description The issue concerns a Cross-Site Scripting (XSS) flaw. It is exploited via the id parameter in the "wp-admin/admin-ajax.php?action=get soundcloud player" API endpoint.

Recommendations For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php?action=get soundcloud player" API endpoint to minimize the risk of exploitation. Avoid using the id parameter in this endpoint until the issue is resolved.