Floating Window Music Player
Floating Window Music Player has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Floating Window Music Player has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Skalucy. Floating Window Music Player is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.9.16.
CVE-2025-48104Floating Window Music Player <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Floating Window Music Player
Author
ericzane
This plugin can play Netease / Tencent / Xiami / Baidu / Kugou / Kuwo music in a floating window. 本插件支持网易、QQ、虾米、百度、酷狗和酷我等音乐歌单的在线播放。 Demo 演示: http://eric.cn.com/ Help 详细说明: http://eric.cn.com/?p=1187 It calls the third-party API(Meting) to get song’s information. 本插件使用了第三方API接口（Meting）以获取歌曲信息。 Netease music 网易云音乐: http://music.163.com/ Tencent music QQ音乐: http://y.qq.com/ Xiami music 虾米音乐: http://www.xiami.com/ Baidu music 百度音乐: http://music.baidu.com/ Kugou music 酷狗音乐: http://www.kugou.com/ Kuwo music 酷我音乐：http://www.kuwo.cn/ Arbitrary section 首次安装后需要保存一下设置； 后台所有文本框选项如需清空已填内容请填入1个空格，否则无法保存； 本插件与同样使用Meting模块的其他插件不相容，如：Hermit X、Netease Music、WP-Player等，请只同时启用其中1个插件。
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C