CVE-2026-16776

Name of the Vulnerable Software and Affected Versions MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar versions prior to 5.14.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via shortcode attributes, which bypass the wp kses post function used by WordPress during save-time, as the payload is not delivered as raw HTML. Consequently, arbitrary web scripts can be injected into pages and executed when a user accesses them.

Recommendations Update the plugin to version 5.14.3 or later.