Threats tagged 'ghsa-fcm6-x3mr-xrh8'

The MP3 Audio Player WordPress plugin versions before 5.16 contain a vulnerability where one of its audio player shortcode attributes is not properly escaped before being output into an HTML attribute. This flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript code. The injected script executes when another user, such as an administrator previewing a pending post, views the content.