WordPress Plugin Vulnerabilities

HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery

Description

The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
html5-audio-player
Fixed in 2.5.2

References

CVE
CVE-2025-13999
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/989b4b9d-e22e-46a7-8ebc-5c8b33f98111

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
kr0d
Verified
No
WPVDB ID
2423deaf-fad2-4284-b6c0-28aa256a690b

Timeline

Publicly Published
2025-12-18 (about 6 months ago)
Added
2025-12-18 (about 6 months ago)
Last Updated
2025-12-19 (about 6 months ago)

Other

Published
Title
Published
2025-08-20
Title
rajce <= 0.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2025-11-04
Title
B Carousel Block – Responsive Image and Content Carousel < 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-02-26
Title
OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery
Published
2025-01-21
Title
AI Power: Complete AI Pack < 1.8.97 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-05-01
Title
PixelYourSite Pro < 12.5.0.2 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter