CVE-2024-5664: 
WordPress vulnerability analysis and mitigation

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaar_audioplayer shortcode in versions up to and including 5.5. This vulnerability was discovered in July 2024 (Wordfence Advisory).

The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes within the plugin's sonaar_audioplayer shortcode. Specifically, the 'id' attribute is not properly validated before being processed and displayed (NVD).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to theft of sensitive information or manipulation of page content (NVD).

Users should update to version 5.6 or later of the MP3 Audio Player plugin which contains fixes for this vulnerability. The fix has been implemented through improved input validation and output escaping (WordPress Plugin).