CVE-2026-111967

MediumCVSS 6.8/10Last modified Oct 28, 2026

Description

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownMP3 Audio Player>= 5.9, < 5.16

References

Timeline

Published
Oct 28, 2026
Last modified
Oct 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-111976.5Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendereCVE-2026-1119716.8The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names beforCVE-2026-1119724.9The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeteCVE-2026-1119745.3The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparinCVE-2026-1119765.3The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public fronCVE-2026-1119786.0The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing usersCVE-2026-1119796.8The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputtCVE-2026-111989.6Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perforCVE-2026-1119805.5The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users wiCVE-2026-1119812.7The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who havCVE-2026-1119827.2The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on iCVE-2026-1119844.3A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file
CVE-2026-111967: Medium severity, CVSS 6.8 | Vulnix