{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5340", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-29T21:55:42.583Z", "datePublished": "2025-06-03T11:22:25.063Z", "dateUpdated": "2026-04-08T16:37:49.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:49.108Z"}, "affected": [{"vendor": "smartwpress", "product": "Music Player for Elementor \u2013 Audio Player & Podcast Player", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018album_buy_url\u2019 parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/193d9625-34ab-497f-987e-5a53ca01e73e?source=cve"}, {"url": "https://wordpress.org/plugins/music-player-for-elementor/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/music-player-for-elementor/tags/2.4.6/classes/widgets/slide-music-player-free.php#L1205"}, {"url": "https://plugins.trac.wordpress.org/changeset/3304812/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-06-02T22:20:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-03T13:13:18.965342Z", "id": "CVE-2025-5340", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T13:13:25.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-03T13:13:18.965342Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-03T13:13:22.163Z"}}], "cna": {"title": "Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "smartwpress", "product": "Music Player for Elementor \u2013 Audio Player & Podcast Player", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.4.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-02T22:20:46.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/193d9625-34ab-497f-987e-5a53ca01e73e?source=cve"}, {"url": "https://wordpress.org/plugins/music-player-for-elementor/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/music-player-for-elementor/tags/2.4.6/classes/widgets/slide-music-player-free.php#L1205"}, {"url": "https://plugins.trac.wordpress.org/changeset/3304812/"}], "descriptions": [{"lang": "en", "value": "The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018album_buy_url\u2019 parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-06-03T11:22:25.063Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5340", "state": "PUBLISHED", "dateUpdated": "2025-06-03T13:13:25.619Z", "dateReserved": "2025-05-29T21:55:42.583Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-03T11:22:25.063Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018album_buy_url\u2019 parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Music Player para Elementor de WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del par\u00e1metro \u00abalbum_buy_url\u00bb en todas las versiones hasta la 2.4.6 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5340", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-03T12:15:22.603", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/music-player-for-elementor/tags/2.4.6/classes/widgets/slide-music-player-free.php#L1205"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3304812/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/music-player-for-elementor/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/193d9625-34ab-497f-987e-5a53ca01e73e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:53:31.005375+00:00", "value": {"mitigation_remediation": ["Upgrade the Music Player for Elementor plugin to the latest stable release, which removes or fixes the unsanitized album_buy_url handling.", "If an upgrade is not possible, temporarily disable the plugin or remove the album_buy_url feature to prevent the storage of user\u2011controlled URLs.", "Strengthen role and permission configuration so that only trusted administrators have Contributor or higher privileges, and audit the plugin configuration to ensure proper input validation and output encoding for all user\u2011supplied fields."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The flaw affects the smartwpress Music Player for Elementor \u2013 Audio Player & Podcast Player plugin on WordPress sites. All releases up through 2.4.6 are vulnerable; any site running one of these bundled versions is at risk if it has a user who can edit album entries.", "description_and_impact": "Music Player for Elementor contains a stored cross\u2011site scripting flaw in the album_buy_url field that is not sanitized or escaped. An authenticated user with Contributor or higher privileges can insert arbitrary JavaScript into this parameter. When a visitor opens the affected album page, the stored payload is rendered and executed in the visitor\u2019s browser, enabling a range of attacks from defacement to credential theft. The weakness is a classic Stored XSS vulnerability (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate risk, while the EPSS score of less than 1\u202f% suggests a low current probability of exploitation. The vulnerability is not listed by CISA in the KEV catalog. Exploitation requires the attacker to obtain Contributor\u2011level or higher authentication on the target site, after which the attacker can craft a malicious payload that is stored in album_buy_url and later delivered to any user who visits the page, executing arbitrary JavaScript."}}}}, "created": "2026-04-22T15:00:05.617969+00:00", "updated": "2026-04-22T15:00:05.617983+00:00", "vendors": []}