What is GHSA-fcm6-x3mr-xrh8?

GHSA-fcm6-x3mr-xrh8 is a security advisory published by GitHub Security Advisories with Medium severity. The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player...

Which CVE IDs does GHSA-fcm6-x3mr-xrh8 cover?

GHSA-fcm6-x3mr-xrh8 covers the following CVE IDs: CVE-2026-111967. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fcm6-x3mr-xrh8?

GHSA-fcm6-x3mr-xrh8 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-fcm6-x3mr-xrh8MediumCVSS 6.8

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-111967 →

📋 Description

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111967
https://wpscan.com/vulnerability/b0013531-eecd-4cbc-a0d2-2872384e6f3c
https://github.com/advisories/GHSA-fcm6-x3mr-xrh8