CVE-2025-9952

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9952", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-03T13:49:23.099Z", "datePublished": "2025-10-04T03:33:30.641Z", "dateUpdated": "2026-04-08T17:13:31.893Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:31.893Z"}, "affected": [{"vendor": "sergiotrinity", "product": "Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.20.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a68ca792-6870-4e28-b118-ee1125842955?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L37"}, {"url": "https://plugins.trac.wordpress.org/changeset/3371934/trinity-audio/trunk/admin/inc/post-management.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "timeline": [{"time": "2025-09-21T15:23:31.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-03T14:29:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T15:53:57.299772Z", "id": "CVE-2025-9952", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T15:54:05.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9952", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T15:53:57.299772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T15:54:01.906Z"}}], "cna": {"title": "Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "sergiotrinity", "product": "Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.20.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-21T15:23:31.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-03T14:29:21.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a68ca792-6870-4e28-b118-ee1125842955?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L44"}, {"url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L37"}, {"url": "https://plugins.trac.wordpress.org/changeset/3371934/trinity-audio/trunk/admin/inc/post-management.php"}], "descriptions": [{"lang": "en", "value": "The Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-04T03:33:30.641Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9952", "state": "PUBLISHED", "dateUpdated": "2025-10-06T15:54:05.998Z", "dateReserved": "2025-09-03T13:49:23.099Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-04T03:33:30.641Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio", "vendor": "sergiotrinity", "versions": [{"lessThanOrEqual": "5.20.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin para WordPress Trinity Audio - Text to Speech AI audio player para convertir contenido en audio es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'range-date' en todas las versiones hasta la 5.20.2, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-9952", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9952", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T15:53:57.299772Z", "version": "2.0.3"}}]}, "published": "2025-10-04T04:16:24.937", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L37"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L44"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3371934/trinity-audio/trunk/admin/inc/post-management.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a68ca792-6870-4e28-b118-ee1125842955?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:29:32.006013+00:00", "value": {"mitigation_remediation": ["Install the latest version of the Trinity Audio plugin when it becomes available, which is expected to remove the vulnerable \"range\u2011date\" handling.", "Validate and sanitize the 'range-date' parameter on the server side and use proper output encoding before echoing it back to the browser.", "Apply a strict Content Security Policy that disallows inline scripts and blocks JavaScript execution from URL parameters, or otherwise restrict script execution in the affected pages."], "summary": {"action": "Update Plugin", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Trinity Audio plugin from the vendor sergiotrinity, specifically versions up to and including 5.20.2, are affected. The flaw exists in all releases of the plugin in that range, independent of the WordPress core version or other plugins.", "description_and_impact": "The Trinity Audio \u2013 Text to Speech AI audio player plugin for WordPress contains a reflected XSS flaw (CWE\u201179) caused by inadequate sanitization of the \u201crange\u2011date\u201d URL parameter. When the parameter is echoed back without proper encoding, an attacker can embed malicious JavaScript that executes in the victim\u2019s browser whenever a user follows a crafted link. This client\u2011side code execution can be used for phishing, defacement, or credential theft, and the vulnerability is exploitable by unauthenticated users.", "risk_and_exploitability": "The CVSS base score of 6.1 indicates a moderate severity reflected XSS. The EPSS score of less than 1% reflects a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trivially create a malicious link containing a crafted \u201crange\u2011date\u201d value, luring a victim to click it; the injected script runs under the site\u2019s domain, granting the attacker control of the victim\u2019s session or the ability to exfiltrate data."}}}}, "created": "2025-10-06T14:42:03.665856+00:00", "updated": "2026-04-21T02:30:25.836503+00:00", "vendors": ["sergiotrinity", "sergiotrinity$PRODUCT$trinity_audio", "wordpress", "wordpress$PRODUCT$wordpress"]}