CVE-2025-13999

Name of the Vulnerable Software and Affected Versions HTML5 Audio Player WordPress Plugin versions 2.4.0 through 2.5.1

Description The HTML5 Audio Player WordPress Plugin is susceptible to a Server-Side Request Forgery (SSRF) condition. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. The issue resides within the getIcyMetadata() function and can be leveraged to query and modify information from internal services.

Recommendations Update to version 2.5.2 or later.