Sp*tify Play Button for WordPress
Sp*tify Play Button for WordPress has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 4 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Cross-Site Request Forgery (CSRF).
Every one of the 4 issues recorded for Sp*tify Play Button for WordPress has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Sp*tify Play Button for WordPress is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2024-11192Spotify Play Button for WordPress <= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode
Read the full analysisVulnerability Records

Sp*tify Play Button for WordPress
Author
Johan Jonk Stenström
Now with Gutenberg block! Sp*tify Play Button lets you easily add a Spotify Play Button for instant play of album, playlist or song by adding the Sp*tify Play Button for WordPress block or adding a shortcode: Album example: [spotifyplaybutton play=”https://open.spotify.com/album/5PvkD4XryLL9oC4NFItYIM?si=pT6des85S6WPQY7O9ipGPw”] Also works with old Spotify URI: [spotify:album:7JggdVIipgSShK1uk7N1hP] Playlist example: [spotifyplaybutton play=”https://open.spotify.com/playlist/37i9dQZF1E39g1r00WoOvS?si=e05ab8be00c24b39″] Also works with old Spotify URI: [spotify:user:jonk:playlist:65ujzBs6WTdWDIr17dOXUm] Song example: [spotifyplaybutton play=”https://open.spotify.com/track/6te1QldCR1BWiNgwZADpu4?si=ee0dfebaa2944756″] Also works with old Spotify URI: [spotify:track:2qntSA2cwerjTduHPuKnW5] You don’t have to remember these shortcodes. If you are using Gutenberg, there is a block with all the settings you need. And if you’re using the Classic editor there’s a Sp*tify Play Button in the editor. Simply right click on album, playlist or song in Spotify and click “Share” and then click “URI”. Either paste that together with the shortcode above or just use the admin button and paste the URI there. You can set the style for your Sp*tify Play Buttons on the “Sp*tify Play Button Settings” page under the “Settings” menu (http://YOURBLOG/wp-admin/options-general.php?page=spotifyplaybutton_settings). You can also add attributes to customize a single Sp*tify Play Button: view size sizetype link All of these will override the settings in “Sp*tify Play Button Settings” for the Sp*tify Play Button and they are all optional. Example: [spotifyplaybutton play="https://open.spotify.com/playlist/2Xm7KEL5NFHwPboQY22BcZ?si=c99d69e2c916447b" size="0" sizetype="big"]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C