PT-2025-52419 · WordPress · Html5 Audio Player Wordpress Plugin

Kenneth Dunn · CVE-2025-13999 · Published 2025-12-19 · Updated 2025-12-24

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HTML5 Audio Player WordPress Plugin versions 2.4.0 through 2.5.1

Description The HTML5 Audio Player WordPress Plugin is susceptible to a Server-Side Request Forgery (SSRF) condition. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. The issue resides within the getIcyMetadata() function and can be leveraged to query and modify information from internal services.

Recommendations Update to version 2.5.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-13999

Affected Products

Html5 Audio Player Wordpress Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13999 · Security Note
• https://plugins.trac.wordpress.org/changeset?old=3394789&old_path=html5-audio-player%2Ftags%2F2.5.1%2Finc%2FCore%2FAjax.php&new=3419843&new_path=html5-audio-player%2Ftags%2F2.5.2%2Finc%2FCore%2FAjax.php · Note
• https://twitter.com/CVEnew/status/2002099184049258608 · Twitter Post
• https://t.me/cveNotify/146298 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/989b4b9d-e22e-46a7-8ebc-5c8b33f98111?source=cve · Note
• https://twitter.com/cracbot/status/2003782762130706612 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002007791448248599 · Twitter Post
• https://t.me/CVEtracker/40242 · Telegram Post