CVE-2026-78283 Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Affected products and versions

Product	Affected versions	Fixed in
Music Player for WooCommerce 1.8	earliest → 1.8.9	No fix stated

Other CVEs of Music Player for WooCommerce

The 3 CVEs of Music Player for WooCommerce →

CVE-2026-93624 Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions 7.2 High CVE-2025-47472 Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows… 5.4 Medium