Description

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-02T08:16:41.730Z",
  "pubdate": "2026-09-02T08:16:41.730Z",
  "executiveSummary": "The Easy Waveform Player plugin for WordPress, in all versions up to and including 1.2.2, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and insufficient output escaping within the plugin's shortcode processing logic.\nThe vulnerability permits authenticated attackers, holding a minimum of Contributor-level privileges, to inject arbitrary JavaScript payloads into posts or pages.\nWhen a user or administrator subsequently views the affected page, the malicious script executes within the context of their session.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the victim, potential session hijacking, redirection to malicious domains, or the exfiltration of sensitive site data.\nThe risk is categorized as significant because it allows lateral movement within the WordPress environment through the compromise of privileged accounts.",
  "technicalDetails": "The root cause of this vulnerability is located within the shortcode_easywaveformplayer() function, which fails to perform necessary security validation on user-supplied parameters passed to the shortcode.\nWordPress shortcodes allow users to embed dynamic content, but when these shortcodes accept attributes that are subsequently reflected in the HTML response without appropriate sanitization, they become conduits for injection attacks.\nIn this specific implementation, input attributes associated with the waveform player are processed and rendered directly into the Document Object Model (DOM) without undergoing sanitization via functions like sanitize_text_field() or escaping via esc_html() or esc_attr().\nAn attacker with at least Contributor-level access can author a new post or modify an existing one, inserting a crafted shortcode containing malicious script tags or event handlers within the vulnerable parameters.\nThe attack flow follows these steps: 1. The attacker authenticates as a Contributor. 2. The attacker crafts a malicious shortcode payload targeting the vulnerable function. 3. The attacker saves this content into the WordPress database. 4. Upon rendering the page, the plugin outputs the unsanitized malicious code to the client-side browser. 5. The victim's browser executes the payload as legitimate script content.\nBecause the payload is stored persistently in the database, the script executes every time the affected page is loaded by any user, including high-privilege administrators.\nThe absence of proper output encoding allows the bypass of standard browser-based XSS filtering in certain scenarios, as the injected content is treated as part of the page's legitimate markup.\nThe impact is severe as it enables the execution of arbitrary JavaScript, which can be utilized to steal session cookies (if 'HttpOnly' flags are absent), perform unauthorized administrative actions (CSRF), or deface the website.\nThe vulnerability is restricted to authenticated users, meaning that while the attack surface is limited to logged-in users, the impact on site integrity is high given the capability of Contributor accounts to contribute content."
}