{"id":"CVE-2026-111967","published":"2026-10-28T06:16:34.843","lastModified":"2026-10-28T06:16:34.843","description":"The MP3 Audio Player  WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}