High severity7.2NVD Advisory· Published Dec 19, 2025· Updated Apr 15, 2026

CVE-2025-13999

Description

The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected products

WordPress/Html5 Audio Playerinferred
Range: >=2.4.0,<=2.5.1
Package: https://wordpress.org/plugins/html5-audio-player
Se Html5 Album Audio Player Project/Se Html5 Album Audio Playerllm-fuzzy
Range: >=2.4.0, <=2.5.1

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/989b4b9d-e22e-46a7-8ebc-5c8b33f98111nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000