Is CVE-2023-54351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-54351 being exploited in the wild.

How severe is CVE-2023-54351?

High severity, with a CVSS score of 7.2, published 8 June 2026.

Which products and versions are affected?

Sonaar Music Plugin 4.7 and earlier.

Is there a fix for CVE-2023-54351?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-54351 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-54351?

Check whether you run Sonaar Music Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-54351: Sonaar Music Plugin stored XSS in comment functionality

CVE-2023-54351 · Severity: high · CVSS 7.2 · Published 2026-06-08

The Sonaar Music Plugin for WordPress, which is used to manage and display music playlists, contains a security flaw in its comment system. An unauthorized attacker can post a malicious script that becomes permanently stored on the website's playlist pages. When other users or administrators view these pages, the script executes in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.

Vendors: Sonaar.

Quick answers

Is CVE-2023-54351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-54351 being exploited in the wild.
How severe is CVE-2023-54351?: High severity, with a CVSS score of 7.2, published 8 June 2026.
Which products and versions are affected?: Sonaar Music Plugin 4.7 and earlier.
Is there a fix for CVE-2023-54351?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-54351 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-54351?: Check whether you run Sonaar Music Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Sonaar Music Plugin for WordPress (version 4.7 and potentially earlier) due to improper neutralization of user input in the comment functionality. An unauthenticated attacker can send a POST request to 'wp-comments-post.php' containing a malicious JavaScript payload in the 'comment' parameter. This payload is stored in the database and subsequently executed in the security context of any user, including administrators, who visits the affected playlist page. This can lead to session hijacking, unauthorized administrative actions, or website defacement. While the vulnerability is confirmed in version 4.7, users are advised to check for updates from the vendor.

Affected products

Sonaar Sonaar Music Plugin 4.7 and earlier

Timeline

2023-09-05: other: Vulnerability discovered by researcher
2023-10-09: disclosed: Exploit published on Exploit-DB
2026-06-08: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.