← Vulnerability feed

Vulnerability record · CVE-2021-24624 · published 1 November 2021

CVE-2021-24624: Sonaar mp3 audio player for music\ cross-site scripting vulnerability

Sonaar · Mp3 Audio Player For Music\

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks

4.8 CVSS 3.1 Medium EPSS 0.64% · top 51.2% CWE-79 · Cross-site scripting
4.8CVSS 3.1 base score, v2 3.5
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/d79d2f6a-257a-4c9e-b971-9837abd4211c ExploitThird Party Advisory
https://wpscan.com/vulnerability/d79d2f6a-257a-4c9e-b971-9837abd4211c ExploitThird Party Advisory

Track CVE-2021-24624 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-56266Sonaar mp3 audio player for music\ missing authorization vulnerabilityMissing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Funct…EPSS 0.33%8.8CVE-2023-47822Sonaar mp3 audio player for music\ missing authorization vulnerabilityMissing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Ac…EPSS 0.43%8.1CVE-2024-7856Sonaar mp3 audio player for music\ missing authorization vulnerabilityThe MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due …EPSS 19%7.6CVE-2024-30487Sonaar mp3 audio player for music\ missing authorization vulnerabilityMissing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Mus…EPSS 0.48%7.5CVE-2024-31343Sonaar mp3 audio player for music\ missing authorization vulnerabilityMissing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Mus…EPSS 0.55%5.4CVE-2024-10268Sonaar mp3 audio player for music\ cross-site scripting vulnerabilityThe MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi…EPSS 0.34%5.4CVE-2024-5664Sonaar mp3 audio player for music\ cross-site scripting vulnerabilityThe MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' …EPSS 0.33%5.4CVE-2024-30530Sonaar mp3 audio player for music\ cross-site scripting vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar Music MP3 Audio Player for Music, Radio …EPSS 0.34%

Source: NIST National Vulnerability Database (record CVE-2021-24624), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.