CVE-2025-9952
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Trinity Audio – Text to Speech AI audio player plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to and including 5.20.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user is tricked into clicking a link.
Risk Assessment
Malicious scripts executing in the user's browser after clicking a link could lead to data theft or session hijacking.
Recommendation
Update the Trinity Audio plugin to the latest patched version and educate users about the risks of clicking suspicious links.
Other vulnerabilities in Trinity Audio
See all- CVE-2025-67466Medium
The Trinity Audio plugin for WordPress (versions up to and including 5.23.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows unauthorized users to perform operations that should be protected.
- CVE-2025-9886Medium
The Trinity Audio – Text to Speech AI plugin for WordPress up to version 5.20.2 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. Unauthenticated attackers can activate/deactivate posts via a forged request if they trick a site administrator into clicking a link.
Original NVD description (English source)
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS