CVE-2026-111967: Stored XSS in MP3 Audio Player plugin

CVE-2026-111967 is a Stored XSS vulnerability in the WordPress MP3 Audio Player plugin (versions < 5.16). The plugin fails to properly escape the audio player shortcode attribute before inserting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript. The injected code executes when another user, typically an administrator, views the content where the payload has been inserted.

The vulnerability is rated CVSS 6.8 (medium), but the potential impact is significant: since injected code executes in the administrator context, an attacker can create new admin accounts, steal session tokens, or modify the site. The CVE was published on 2026-10-28 by NVD. Public signals on GitHub (2026-11-08) document the existence of repositories claiming to contain proof-of-concept code for vulnerable versions up to 5.14. No confirmation of active wild exploitation has been reported.

Defenders must immediately update the MP3 Audio Player plugin to version 5.16 or later. In parallel, it is critical to audit posts and drafts created by Contributor-level users or higher since the CVE publication date (2026-10-28) to identify suspicious JavaScript in attributes. Where feasible, restrict Contributor permissions to users who genuinely require them to reduce the attack surface.