nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-54351 CVE-2023-54351
MEDIUM
WordPress Sonaar Music Plugin 4.7 Stored XSS via Comments
Record summary
CVE-2023-54351 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 8, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Sonaar Music PluginBrowse Sonaar / Sonaar Music Plugin | CVE List | 4.7 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBWordpress Sonaar Music Plugin 4.7 - Stored XSSExploitDB exploitby Furkan KaraarslanNot analyzed1 file
References
3ExploitDB-51739exploit
https://www.exploit-db.com/exploits/51739 VulnCheck Advisory: WordPress Sonaar Music Plugin 4.7 Stored XSS via CommentsThird-party advisory
https://www.vulncheck.com/advisories/wordpress-sonaar-music-plugin-stored-xss-via-comments