SecPod

Learn Search

Search across all Learn content

← Back to Security Research

WordPress HTML5 MP3 Player with Playlist plugin XSS and SQL Injection Vulnerabilities

SecPod Research Team member (Thanga Prakash) has found Multiple Cross-site Scripting Vulnerabilities and SQL injection vulnerability in WordPress HTML5 MP3 Player with Playlist plugin. The vulnerability is caused by improper validation of various parameters in various pages. This may allow an attack...

Jun 15, 2015By Thanga Prakash1 min read

SecPod Research Team member (Thanga Prakash) has found Multiple Cross-site Scripting Vulnerabilities and SQL injection vulnerability in WordPress HTML5 MP3 Player with Playlist plugin. The vulnerability is caused by improper validation of various parameters in various pages. This may allow an attacker to steal cookie-based authentication credentials, inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Complete Advisory information can be found here.

Advisory in CVRF format can be found here.

Welcome any feedback or suggestions.

Cheers!
SecPod Research Team

Featured Posts

Open Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws
Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

CVE Research

Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

Sep 11, 2026

Open CVE-2026-87491: Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026
CVE-2026-87491: Google Fixes 7th Exploited Chrome Zero-Day of 2026

CVE Research

CVE-2026-87491: Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026

Sep 10, 2026

Open Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release
Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release

CVE Research

Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, infrastructure services, virtualization components and other Microsoft products.

Sep 9, 2026

Open MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover
MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover

CVE Research

MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover

Sep 8, 2026