CVE-2023-54351: Sonaar Music Plugin

High severity, CVSS 7.2. EPSS: 0.2% chance of exploitation in the next 30 days.

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.

Affected products

• Sonaar Sonaar Music Plugin: version 4.7 only

Published 2026-06-08. Last modified 2026-07-23.