WordPress plugin
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 19 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium16
- Low0
All MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerabilities
- Medium6.45.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
5.9 – 5.15Update to 5.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤5.14.2Update to 5.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.14.2Update to 5.15
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.13.1Update to 5.14
- Medium5.3Missing Authorization
≤5.12Update to 5.13
- Medium5.35.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
4.0 – 5.10Update to 5.11
- High7.2Unauthenticated Server-Side Request Forgery
≤5.11Update to 5.12
- Medium5.05.10 - Authenticated (Author+) Server-Side Request Forgery
5.3 – 5.10Update to 5.11
- Medium4.3Missing Authorization
≤5.9.4Update to 5.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed
≤5.9.3Update to 5.9.4
- Medium4.3Missing Authorization
≤5.8Update to 5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
≤5.8Update to 5.9
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
≤5.7.0.1Update to 5.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
≤5.5Update to 5.6
- Medium5.3Unauthenticated Arbitrary File Download
≤4.10.1Update to 5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1Update to 5.1.1
- Medium4.3Missing Authorization
≤5.1Update to 5.1.1
- Medium5.4Missing Authorization to Template Import
≤4.10Update to 4.10.1
- Medium5.5Multiple Admin+ Cross Site Scripting
≤2.4.1Update to 2.4.2
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: common questions
Does MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: 3 high, 16 medium. None are known to affect version null.
How do I check which version of MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerability?
CVE-2026-111967, published Oct 28, 2026: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.9 - 5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerability listed in CISA KEV?
No. None of the known MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar vulnerabilities is currently listed in the CISA KEV catalog.