Executive brief
The Wavr plugin for WordPress, which is used to display audio waveforms, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.
Technical details
The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the 'wave' shortcode. The vulnerability exists in all versions up to and including 0.2.6. An authenticated attacker with at least contributor-level privileges can exploit this by embedding malicious scripts into a post or page using the shortcode. Because the plugin fails to properly neutralize these inputs, the script is stored on the server and executed in the context of the victim's browser session whenever the page is viewed. This is classified as CWE-79.
Affected products
- lucascaro Wavr up to, and including, 0.2.6
Timeline
- 2026-04-08: disclosed: Initial publication of the CVE record
- 2026-04-08: advisory: Wordfence published the vulnerability details
References
- https://plugins.trac.wordpress.org/browser/wavr/tags/0.2.6/wavr.php
- https://plugins.trac.wordpress.org/browser/wavr/tags/0.2.6/wavr.php
- https://plugins.trac.wordpress.org/browser/wavr/trunk/wavr.php
- https://plugins.trac.wordpress.org/browser/wavr/trunk/wavr.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d8987bc5-2bc0-4a92-bcf0-cc3245e15bed?source=cve