WordPress Plugin Vulnerabilities

Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

Description

The plugin does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post).

Proof of Concept

Affects Plugins

Plugin icon
audio-player-block
Fixed in 1.6.3

References

CVE
CVE-2026-85415

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Philipp Doblhofer
Submitter
Philipp Doblhofer
Submitter website
https://www.codeaware.at
Verified
Yes
WPVDB ID
3ca9c087-311b-4c55-8871-fba318f654b3

Timeline

Publicly Published
2026-09-28 (about 2 days ago)
Added
2026-09-28 (about 1 day ago)
Last Updated
2026-09-28 (about 1 day ago)

Other

Published
Title
Published
2026-04-07
Title
Element Pack Addons for Elementor < 8.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget
Published
2025-03-03
Title
Master Addons < 2.0.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2025-10-14
Title
Penci Bookmark & Follow < 2.4 - Unauthenticated Stored Cross-Site Scripting
Published
2024-10-24
Title
WP Abstracts < 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-09-26
Title
Lenix scss compiler <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting