Music Player for Elementor contains a stored cross‑site scripting flaw in the album_buy_url field that is not sanitized or escaped. An authenticated user with Contributor or higher privileges can insert arbitrary JavaScript into this parameter. When a visitor opens the affected album page, the stored payload is rendered and executed in the visitor’s browser, enabling a range of attacks from defacement to credential theft. The weakness is a classic Stored XSS vulnerability (CWE‑79).

The flaw affects the smartwpress Music Player for Elementor – Audio Player & Podcast Player plugin on WordPress sites. All releases up through 2.4.6 are vulnerable; any site running one of these bundled versions is at risk if it has a user who can edit album entries.

The CVSS score of 6.4 indicates moderate risk, while the EPSS score of less than 1 % suggests a low current probability of exploitation. The vulnerability is not listed by CISA in the KEV catalog. Exploitation requires the attacker to obtain Contributor‑level or higher authentication on the target site, after which the attacker can craft a malicious payload that is stored in album_buy_url and later delivered to any user who visits the page, executing arbitrary JavaScript.