svnlabs vulnerabilities

Products

• html5 mp3 player with playlist free 2
• html5 mp3 player with folder feedburner playlist free 1
• html5 soundcloud player with playlist free 1
• Shoutcast Icecast HTML5 Radio Player 1

Latest svnlabs CVEs

Newest publication first

1. CVE-2024-8666 Shoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2024-10-25

   Medium·CVSS 6.4 EPSS 0.29%

   The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. T...

2. CVE-2023-52202 WordPress HTML5 MP3 Player with Folder Feedburner Plugin <= 2.8.0 is vulnerable to PHP Object Injection

   Published 2024-01-08

   High·CVSS 7.2 EPSS 0.62%

   Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.

3. CVE-2023-52205 WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection

   Published 2024-01-08

   High·CVSS 7.2 EPSS 0.62%

   Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.

4. CVE-2023-52207 WordPress HTML5 MP3 Player with Playlist Free Plugin <= 3.0.0 is vulnerable to PHP Object Injection

   Published 2024-01-08

   High·CVSS 8.8 EPSS 0.62%

   Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.

5. CVE-2014-9177 HTML5 MP3 Player with Playlist <= 2.7.0 - Full Path Disclosure

   Published 2014-12-02

   Medium·CVSS 5.0 EPSS 2.6%

   The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.