MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

Information

Software Type Plugin
Software Slug mp3-music-player-by-sonaar (view on wordpress.org)
Software Status Active
Software Author sonaar
Software Website sonaar.io
Software Downloads 862,693
Software Active Installs 20,000
Software Record Last Updated July 15, 2026

14 Vulnerabilities

Submit a Vulnerability
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
5.3
CVE-2026-1219
Feb 18, 2026
Researcher: kr0d
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-39647
Feb 15, 2026
Researcher: johska
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery
5.0
CVE-2026-1249
Feb 13, 2026
Researcher: kr0d
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization
4.3
CVE-2025-32235
Apr 4, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed
6.4
CVE-2024-13157
Jan 30, 2025
Researcher: Webbernaut
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization
4.3
CVE-2024-56266
Dec 30, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
6.4
CVE-2024-10268
Nov 18, 2024
Researcher: Peter Thaleikis
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2024-7856
Aug 28, 2024
Researcher: Arkadiusz Hydzik
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
6.4
CVE-2024-5664
Jul 9, 2024
Researcher: wesley (wcraft)
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download
5.3
CVE-2024-31343
Apr 5, 2024
Researcher: beluga
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-30530
Mar 29, 2024
Researcher: Steven Julian
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization
4.3
CVE-2024-30487
Mar 28, 2024
Researcher: Steven Julian
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import
5.4
CVE-2023-47822
Nov 15, 2023
Researcher: Abdi Pranata
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting
5.5
CVE-2021-24624
Oct 4, 2021
Researcher: apple502j
Title Status CVE ID CVSS Researchers Date
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure Patched CVE-2026-1219 5.3 kr0d February 18, 2026
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery Patched CVE-2026-39647 7.2 johska February 15, 2026
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery Patched CVE-2026-1249 5.0 kr0d February 13, 2026
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization Patched CVE-2025-32235 4.3 Trương Hữu Phúc (truonghuuphuc) April 4, 2025
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed Patched CVE-2024-13157 6.4 Webbernaut January 30, 2025
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization Patched CVE-2024-56266 4.3 Trương Hữu Phúc (truonghuuphuc) December 30, 2024
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode Patched CVE-2024-10268 6.4 Peter Thaleikis November 18, 2024
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion Patched CVE-2024-7856 8.1 Arkadiusz Hydzik August 28, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode Patched CVE-2024-5664 6.4 wesley (wcraft) July 9, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download Patched CVE-2024-31343 5.3 beluga April 5, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-30530 6.4 Steven Julian March 29, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization Patched CVE-2024-30487 4.3 Steven Julian March 28, 2024
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import Patched CVE-2023-47822 5.4 Abdi Pranata November 15, 2023
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting Patched CVE-2021-24624 5.5 apple502j October 4, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation