Reflected Cross-Site Scripting Vulnerability in Trinity Audio Plugin for WordPress
CVE-2025-9952
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 October 2025
What is CVE-2025-9952?
The Trinity Audio plugin for WordPress, designed for converting content into audio, contains a reflected cross-site scripting vulnerability. This flaw arises from insufficient input sanitization and output escaping, specifically through the 'range-date' parameter. Attackers, not requiring authentication, can exploit this vulnerability by injecting arbitrary web scripts into pages. If users unknowingly perform actions like clicking on a malicious link, these scripts can execute, potentially compromising user data and site integrity.
Affected Version(s)
Trinity Audio – Text to Speech AI audio player to convert content into audio * <= 5.20.2