CVE-2024-13157 is a stored cross-site scripting vulnerability classified under CWE-79, found in the Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio WordPress plugin. The vulnerability exists due to insufficient sanitization and escaping of user-supplied input in the Podcast RSS Feed functionality. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript code into podcast feed attributes. This malicious code is stored persistently and executed in the browsers of any users who visit the compromised pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability affects all versions up to and including 5.9.3. The CVSS v3.1 base score is 6.4, reflecting network exploitability with low attack complexity, requiring privileges but no user interaction, and impacting confidentiality and integrity with a scope change. No patches or official fixes are currently linked, and no known exploits have been observed in the wild. The vulnerability highlights the risks of insufficient input validation in WordPress plugins, especially those handling user-generated content or feeds.

The primary impact of this vulnerability is the potential for attackers to execute arbitrary JavaScript in the context of affected WordPress sites. This can lead to theft of authentication cookies, enabling session hijacking and unauthorized access to user accounts. Attackers might also perform actions on behalf of users, inject further malicious content, or redirect users to phishing or malware sites. Since the vulnerability requires contributor-level access, it could be exploited by malicious insiders or compromised accounts. The scope of impact includes all visitors to the infected pages, potentially affecting site administrators, editors, and end-users. Organizations relying on this plugin for podcast or audio content delivery face risks of reputational damage, data breaches, and compliance violations. The medium severity score indicates a significant but not critical threat, yet the persistent nature of stored XSS can facilitate prolonged exploitation if unaddressed.

Immediate mitigation steps include restricting contributor-level user permissions to trusted individuals only and monitoring for suspicious activity on affected WordPress sites. Administrators should implement web application firewalls (WAFs) with rules targeting XSS payloads in podcast feed inputs. Until an official patch is released, consider disabling or removing the Sonaar MP3 Audio Player plugin if feasible. Site owners can also sanitize and validate podcast feed inputs manually or via custom code to prevent script injection. Regularly audit user-generated content and feeds for malicious scripts. Employ Content Security Policy (CSP) headers to limit the impact of injected scripts. Finally, maintain up-to-date backups and monitor security advisories from Sonaar and WordPress for forthcoming patches.