Tune Library

Tune Library has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 8.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Tune Library has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Tune Library is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh

8.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Tune Library vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2015-3314

Tune Library < 1.5.5 - SQL Injection

Read the full analysis

Vulnerability Records

2 records


2026-02-05 00:00	Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import Tune Library <= 1.6.3	`CVE-2026-1401`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2015-04-20 00:00	Tune Library < 1.5.5 - SQL Injection Tune Library < 1.5.5	`CVE-2015-3314`	9.8 Critical	Hannes Trunde	Yes

Showing 1–2 of 2 reports

Latestv1.6.4

Tune Library

Author

Yannick Lefebvre

4.0(1)

80/100

Last Updated

2026-02-01 (7mo ago)

Active Installs

10+

Downloads

12,786

Requires WP

2.7+

Requires PHP

Tested up to

WP 6.9.7

Created

2009-02-10 (18y ago)

This plugin is used to import an XML iTunes Music Library file into your WordPress database. Once imported, you can display a complete listing of your music collection on a page of your WordPress site. You can try it out in a temporary copy of WordPress here.

View on WordPress.org