CVE-2026-78283

HighCVSS 7.1

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Unauthenticated XSS vulnerability in Music Player for WooCommerce versions up to 1.8.9. An attacker can inject malicious script that executes in the victim's browser.

Risk Assessment

Risk of session theft, account takeover, or malware distribution.

Recommendation

Update the Music Player for WooCommerce plugin to the latest version. Additionally, apply input filtering and output encoding.

Other vulnerabilities in Music Player for WooCommerce

CVE-2026-93624High
The Music Player for WooCommerce plugin versions 1.9.1 and earlier contains a PHP Object Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can exploit this to execute arbitrary code.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS