What is the CVSS score of CVE-2025-7963?

CVE-2025-7963 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Easy Waveform Player CVE-2025-7963

EUVD-2025-210826 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-02 Wordfence

GHSA-j6v4-fgm4-3f8x

WordPress XSS Wordpress Plugin Easy Waveform Player

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Contributor auth required (PR:L); stored payload auto-executes on page load (UI:N); browser scope change applies (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 08:06 vuln.today

CVE Published

Sep 02, 2026 - 07:39 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Easy Waveform Player WordPress plugin (≤1.2.2) allows authenticated Contributor-level users to inject arbitrary JavaScript via the shortcode_easywaveformplayer() function due to missing input sanitization and output escaping. The payload persists server-side and executes in every visitor's browser upon page load, with scope change enabling cross-origin script execution. No public exploit or CISA KEV listing has been identified at time of analysis; a patch commit (changeset 3674516) is visible in the WordPress plugin SVN repository.

Technical ContextAI

The vulnerability resides in the shortcode_easywaveformplayer() function defined in class-easywaveformplayer.php at line 304 of the plugin's trunk. WordPress shortcodes allow Contributor-level users to embed plugin-rendered HTML in posts and pages; when the function processes attacker-controlled shortcode attributes without escaping them before HTML output, those attributes are reflected verbatim into the page DOM. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class. The affected CPE is cpe:2.3:a:tymotey:easy_waveform_player:*:*:*:*:*:*:*:*, covering the tymotey vendor namespace on WordPress.org. The CVSS scope change (S:C) reflects the browser security boundary being crossed when injected scripts run in the victim's origin context.

RemediationAI

Update Easy Waveform Player to the latest available version via the WordPress admin plugin dashboard or directly from https://wordpress.org/plugins/easy-waveform-player/#developers, as changeset 3674516 in the WordPress plugin SVN (https://plugins.trac.wordpress.org/changeset?reponame=&old=3674516%40easy-waveform-player&new=3674516%40easy-waveform-player) indicates a fix was committed - however, the exact patched version number is not independently confirmed from the input data and should be verified against the plugin changelog. If immediate update is not possible, restrict Contributor-level account registration or revoke post-creation capabilities for untrusted contributors, accepting the trade-off that this limits legitimate content creation. Disabling the plugin entirely until updated is the most conservative compensating control. Further advisory detail is available via Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/73347ab9-2248-4402-85bf-8996b342501b?source=cve.