Music Request Manager <= 1.3 – Unauthenticated Stored XSS | CVE 2024-6019 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators

Proof of Concept

1. Add the `[music-requests]` shortcode to a post/page
2. View that page as an unauthenticated user and enter the payload `"><script>alert(1></script>` for either input
3. As an admin, view the page and see the XSS

Affects Plugins

music-request-manager

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

5899c5c9-a550-4c86-a41d-7fcc1e84a7d3

Timeline

Publicly Published

2024-08-22 (about 1 year ago)

Added

2024-08-22 (about 1 year ago)

Last Updated

2024-08-22 (about 1 year ago)

Other

Published

Title

Published

2025-11-26

Title

SortTable Post <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2023-03-03

Title

Manage Upload Limit <= 1.0.4 - Reflected XSS

Published

2025-01-23

Title

ProfilePress < 4.15.20 - Admin+ Stored XSS

Published

2024-11-14

Title

Tripetto <= 8.0.6 - Unauthentiated Stored Cross-Site Scripting via Form File Upload

Published

2024-08-27

Title

Review Ratings <= 1.6 - Stored XSS via CSRF