CVE-2024-30530: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in Sonaar Music MP3 Audio Player for Music, Radio & Podcast WordPress plugin through version 5.1. The vulnerability was discovered and reported on March 4, 2024, and publicly disclosed on March 29, 2024. This stored XSS vulnerability affects all versions of the plugin up to and including version 5.1 (Patchstack Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a slightly higher score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD Database).

The vulnerability allows authenticated attackers with contributor-level access to inject malicious scripts into the website. When executed, these scripts can potentially lead to various malicious activities including redirects, unauthorized advertisements, and execution of other HTML payloads when visitors access the affected site (Patchstack Advisory).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. While the severity is considered low to medium, the attack complexity is low, requiring only network access and user interaction for successful exploitation (NVD Database).

Users are advised to update to version 5.1.1 or later which contains the fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack Advisory).