CVE-2025-7963

Name of the Vulnerable Software and Affected Versions Easy Waveform Player versions prior to 1.2.3

Description Insufficient input sanitization and output escaping in the shortcode easywaveformplayer() function allow authenticated attackers with Contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Easy Waveform Player to a version later than 1.2.2. As a temporary workaround, restrict access to the shortcode easywaveformplayer() function for users with Contributor-level permissions.