CVE-2025-5340

Vulnerability

Overview The Music Player for Elementor plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability in the album_buy_url parameter. The flaw arises from insufficient input sanitization and output escaping, allowing malicious input to be stored and later executed in the context of a user's browser. This affects all versions up to and including 2.4.6 [1].

Exploitation

Prerequisites An attacker must be authenticated with at least Contributor-level access to the WordPress site. The attacker can inject arbitrary web scripts via the album_buy_url parameter when creating or editing a music player widget. The injected script will execute whenever any user accesses the page containing the malicious widget.

Impact

Successful exploitation enables the attacker to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the site. Since the attack is stored, it can affect all visitors to the compromised page, including administrators.

Mitigation

As of the publication date, no patch has been announced. Users are advised to update the plugin to the latest version if a security update becomes available. Until then, restrict Contributor-level access to trusted users only.