CVE-2026-16776: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

CVE-2026-16776 describes a stored cross-site scripting vulnerability in the Sonaar MP3 Audio Player – Music Player, Podcast Player & Radio WordPress plugin. The flaw exists in all versions up to and including 5.14.2 and arises from improper neutralization of input during web page generation, specifically in shortcode attributes. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. The issue bypasses WordPress's wp_kses_post filtering because the malicious payload is delivered via shortcode attributes rather than raw HTML content, allowing unescaped values to persist until render time.

Successful exploitation allows an attacker with contributor-level access or above to inject and execute arbitrary scripts in the browsers of users who view the infected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting its scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.