Compact WP Audio Player 1.9.14 Security Update: XSS Fixes and Nonce Validation

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Plugin Name: Compact WP Audio Player 2. Author: Tips and Tricks HQ 3. Version: 1.9.14 4. Plugin Features: - Output Escaping: Added output escaping for the shortcode parameter. - Autoplay Code Refactoring: Refactored the autoplay JavaScript code to allow easy addition of output escaping. - File URL Validation: Added a settings option and filter to disable URL validation for the file URL parameter. - Relative URL Support: The file URL field now accepts relative URL values (e.g., ). - Non-Latin Character Handling: Added fallback handling for file URL validation failures involving non-Latin characters. - CSS Wrapper Class: Added a CSS wrapper class for the audio player to improve compatibility with block themes. - URL Validation: Validated the URL in the parameter of the shortcode. - PHP 8.2 Compatibility: Added compatibility with PHP 8.2. - Output Escaping: Added output escaping for shortcode parameters. (Thanks to WPScan for pointing this out.) - Attribute Escaping: Escaped attributes within the shortcode. - Nonce Check: Added nonce verification for saving settings menu operations. - WP 5.8 Compatibility: Added compatibility with WordPress 5.8. - iOS 10 Safari Update: Updated the audio player to support iOS 10 Safari. - WordPress 4.6 Compatibility: Compatible with WordPress 4.6. - Autoplay Fix: Fixed an autoplay bug where the pause button icon did not switch back to play after the audio file finished playing (in default template). - WordPress 4.4 Compatibility: Compatible with WordPress 4.4. - Play Button Image Filename Correction: Corrected an error in the play button image filename. - uniqid() Function Change: Modified the function to use the “more_entropy” parameter for more unique values. - Internet Explorer Fix: Fixed minor issues with Internet Explorer. - New Player Template 1 Fix: Fixed minor issues in New Player Template 1 related to the “autoplay” parameter. - New Shortcode Addition: Added a new shortcode for a different audio player with progress bar and volume control. - Audio File Version Specification: Added an option to specify MP3 and OGG versions of the audio file. - Simultaneous Playback Option: Added an option to disable simultaneous playback, which automatically stops currently playing audio when a new file is played. - Auto Loop Option: Added an auto-loop option in the shortcode to loop audio files automatically. - Volume Option: Added a volume option in the shortcode to specify audio volume. - Autoplay Option: Added an autoplay option in the shortcode. - Container Class Specification: Added functionality to specify a container class via shortcode (helpful for CSS customization). - JavaScript Error Fix: Fixed JavaScript errors. This information helps us understand the features and version updates of the Compact WP Audio Player plugin, as well as potential security vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Compact WP Audio Player 1.9.14 Security Update: XSS Fixes and Nonce Validation