Executive brief
The Easy Waveform Player WordPress plugin is used to embed audio players in web content. The plugin fails to properly sanitize user input in shortcodes, allowing authenticated contributors and administrators to inject malicious JavaScript that executes whenever anyone views the affected page, potentially compromising visitor accounts or stealing data.
Technical details
The Easy Waveform Player WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability in the shortcode_easywaveformplayer() function due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript code through shortcode parameters that are stored in the page/post content. When any user accesses the injected page, the malicious script executes in their browser context, allowing session hijacking, data theft, or account compromise. The vulnerability requires authentication but no special privileges beyond Contributor role, making it exploitable by regular contributors on multi-author WordPress sites. The advisory indicates a patch is available, though specific version information is not provided in the reference materials.
Affected products
- Easy Waveform Player Easy Waveform Player up to and including 1.2.2
Timeline
- 2026-09-02: disclosed