Executive brief
The Sonaar Music Plugin for WordPress, which is used to manage and display music playlists, contains a security flaw in its comment system. An unauthorized attacker can post a malicious script that becomes permanently stored on the website's playlist pages. When other users or administrators view these pages, the script executes in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Sonaar Music Plugin for WordPress (version 4.7 and potentially earlier) due to improper neutralization of user input in the comment functionality. An unauthenticated attacker can send a POST request to 'wp-comments-post.php' containing a malicious JavaScript payload in the 'comment' parameter. This payload is stored in the database and subsequently executed in the security context of any user, including administrators, who visits the affected playlist page. This can lead to session hijacking, unauthorized administrative actions, or website defacement. While the vulnerability is confirmed in version 4.7, users are advised to check for updates from the vendor.
Affected products
- Sonaar Sonaar Music Plugin 4.7 and earlier
Timeline
- 2023-09-05: other: Vulnerability discovered by researcher
- 2023-10-09: disclosed: Exploit published on Exploit-DB
- 2026-06-08: advisory: NVD advisory published