Threat Entry Updated 2025-06-04

CVE-2025-5340 - Music Player For Elementor Plugin

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Music Player For Elementor

CVE-2025-5340

MEDIUM CVSS 6.4 2025-06-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-19

CVE-2024-10582 - Music Player For Elementor Plugin

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import templates.

PLUGIN Music Player For Elementor

CVE-2024-10582

MEDIUM CVSS 4.3 2024-11-15

Risk Score

Open Full Technical Breakdown