CVE-2025-9952

MediumCVSS 6.1/10Last modified Oct 11, 2026

Description

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2025
Last modified
Oct 11, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-99539.8Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank AccreditatCVE-2025-99547.5Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.CVE-2025-99555.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internaCVE-2025-99572.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.CVE-2025-99587.7An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, thCVE-2025-99597.6Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smoCVE-2025-99606.9A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affectCVE-2025-99618.6An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.  The exploit can only be CVE-2025-996210.0A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affectsCVE-2025-99639.4A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. ThiCVE-2025-99648.6No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P CVE-2025-99659.3Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to th