The Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio WordPress plugin versions up to 5.5 suffer from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-5664. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of the 'id' attribute within the sonaar_audioplayer shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users visiting the affected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been documented or linked by the vendor as of the publication date.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to unauthorized actions such as session hijacking, defacement, or theft of sensitive information accessible to the victim user. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Sonaar MP3 Audio Player plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.