Missing Authorization
8 records53.3%First: 2023. Latest: 2026.
Plugin security history
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 15 vulnerability records associated with MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar, published between 2021 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
15Total records
0Critical
2High
13Medium
0Low
0Informational
15Patched records
0Currently marked unpatched
2021-10-04First disclosure
2026-07-22Latest disclosure
15 of 15CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2021 | 1 | |
| 2023 | 1 | |
| 2024 | 7 | |
| 2025 | 2 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| High | 2 | 13.3% |
| Medium | 13 | 86.7% |
Vulnerability-Type Breakdown
Cross-Site Scripting
5 records33.3%First: 2021. Latest: 2025.
Other
2 records13.3%First: 2026. Latest: 2026.
Patch Status
- Patched
- 15
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
5.135.125.115.9.55.9.45.95.7.15.65.05.1.14.10.12.4.2
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-5.12 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization | July 22, 2026 | 5.13 | Medium |
4.0-5.10 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure | February 18, 2026 | 5.11 | Medium |
*-5.11 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery | February 15, 2026 | 5.12 | High |
5.3-5.10 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery | February 13, 2026 | 5.11 | Medium |
*-5.9.4 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization | April 4, 2025 | 5.9.5 | Medium |
*-5.9.3 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed | January 30, 2025 | 5.9.4 | Medium |
*-5.8 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization | December 30, 2024 | 5.9 | Medium |
*-5.8 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode | November 18, 2024 | 5.9 | Medium |
*-5.7.0.1 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion | August 28, 2024 | 5.7.1 | High |
*-5.5 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode | July 9, 2024 | 5.6 | Medium |
*-4.10.1 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download | April 5, 2024 | 5.0 | Medium |
*-5.1 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | March 29, 2024 | 5.1.1 | Medium |
*-5.1 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization | March 28, 2024 | 5.1.1 | Medium |
*-4.10 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import | November 15, 2023 | 4.10.1 | Medium |
*-2.4.1 | MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting | October 4, 2021 | 2.4.2 | Medium |
Selected source records
Latest Records
MediumCVE-2026-65506
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-5.12
- Patched versions
- 5.13
MediumCVE-2026-1219
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
Published: February 18, 2026
- Affected versions
- 4.0-5.10
- Patched versions
- 5.11
HighCVE-2026-39647
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery
Published: February 15, 2026
- Affected versions
- *-5.11
- Patched versions
- 5.12
MediumCVE-2026-1249
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery
Published: February 13, 2026
- Affected versions
- 5.3-5.10
- Patched versions
- 5.11
MediumCVE-2025-32235
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization
Published: April 4, 2025
- Affected versions
- *-5.9.4
- Patched versions
- 5.9.5
MediumCVE-2024-13157
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed
Published: January 30, 2025
- Affected versions
- *-5.9.3
- Patched versions
- 5.9.4
MediumCVE-2024-56266
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization
Published: December 30, 2024
- Affected versions
- *-5.8
- Patched versions
- 5.9
MediumCVE-2024-10268
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
Published: November 18, 2024
- Affected versions
- *-5.8
- Patched versions
- 5.9
Highest-Severity Records
HighCVE-2024-7856
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
Published: August 28, 2024
- Affected versions
- *-5.7.0.1
- Patched versions
- 5.7.1
HighCVE-2026-39647
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery
Published: February 15, 2026
- Affected versions
- *-5.11
- Patched versions
- 5.12
MediumCVE-2024-13157
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed
Published: January 30, 2025
- Affected versions
- *-5.9.3
- Patched versions
- 5.9.4
MediumCVE-2024-10268
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
Published: November 18, 2024
- Affected versions
- *-5.8
- Patched versions
- 5.9
MediumCVE-2024-30530
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: March 29, 2024
- Affected versions
- *-5.1
- Patched versions
- 5.1.1
MediumCVE-2024-5664
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
Published: July 9, 2024
- Affected versions
- *-5.5
- Patched versions
- 5.6
MediumCVE-2021-24624
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting
Published: October 4, 2021
- Affected versions
- *-2.4.1
- Patched versions
- 2.4.2
MediumCVE-2023-47822
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import
Published: November 15, 2023
- Affected versions
- *-4.10
- Patched versions
- 4.10.1
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.