CVE-2022-36373 WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Q: What is CVE-2022-36373?

CVE-2022-36373 is a medium-severity vulnerability in Simon Ward MP3-jPlayer (WordPress plugin), published on 1 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2022-36373 being exploited?

There is no known exploitation of CVE-2022-36373 in the wild and no public exploit code.

Q: How do I fix CVE-2022-36373?

No fix has been published for CVE-2022-36373 yet. Limit exposure of the affected software until one is available.

Medium 5.4 Published 1 Sep 2022 Updated 28 Apr 2026

Attackers can trick authenticated users into performing unintended actions in the MP3 jPlayer WordPress plugin via CSRF.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-36373?

CVE-2022-36373 is a medium-severity vulnerability in Simon Ward MP3-jPlayer (WordPress plugin), published on 1 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.

Weakness: CWE-352

Which versions are affected by CVE-2022-36373?

It affects 1 product.

Products include Mp3-Jplayer Project Mp3-Jplayer.

How do I fix CVE-2022-36373?

No fix has been published for CVE-2022-36373 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-36373 being exploited?

There is no known exploitation of CVE-2022-36373 in the wild and no public exploit code.

CVE-2015-1000008 Information disclosure in n/a Medium 5.3

Sources

Also known as GHSA-372g-v68g-cmqj.