Reflected Cross-Site Scripting Vulnerability in Trinity Audio Plugin for WordPress
CVE-2025-9952

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: Trinity Audio – Text To Speech Ai Audio Player To Convert Content Into Audio
Vendor: CVE Published:; 4 October 2025

What is CVE-2025-9952?

The Trinity Audio plugin for WordPress, designed for converting content into audio, contains a reflected cross-site scripting vulnerability. This flaw arises from insufficient input sanitization and output escaping, specifically through the 'range-date' parameter. Attackers, not requiring authentication, can exploit this vulnerability by injecting arbitrary web scripts into pages. If users unknowingly perform actions like clicking on a malicious link, these scripts can execute, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Trinity Audio – Text to Speech AI audio player to convert content into audio * <= 5.20.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/trinity-audio/...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Oct 4, 2025
Vulnerability Reserved
Sep 3, 2025

Credit

Moose Love

JSON

WordPress