CVE-2013-1464

Doryphores Audio Player < 2.0.4.5 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by hiphop · textwebappsphp

https://www.exploit-db.com/exploits/38300

View Code ZIP pw:eip

References (6)

[Various Sources] http://insight-labs.org/?p=738

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html

[Third Party Advisory] http://secunia.com/advisories/52083

[Third Party Advisory] http://secunia.com/advisories/58854

[Patch] http://wordpress.org/extend/plugins/audio-player/changelog/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/57848

Scores

EPSS 0.0352

EPSS Percentile 87.5%

Details

CWE

CWE-79

Status published

Products (10)

doryphores/audio_player < 2.0.4.5

doryphores/audio_player

n/a/n/a

Published Feb 07, 2013

Tracked Since Feb 18, 2026