Codepeople Music Store vulnerabilities

3 CVEs affecting Codepeople Music Store, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-24626, published 2025-01-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-10992, published 2019-09-17. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
CVE-2024-36082, published 2024-06-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands.…
CVE-2025-24626, published 2025-01-27. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.This issue affects Music Store: from n/a…