Threat Entry Updated 2025-06-04

CVE-2025-3431 - Zoomsounds Plugin

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

PLUGIN Zoomsounds

CVE-2025-3431

HIGH CVSS 7.5 2025-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-04

CVE-2025-0839 - Zoomsounds Plugin

The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Zoomsounds

CVE-2025-0839

MEDIUM CVSS 6.4 2025-04-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-04

CVE-2024-13776 - Zoomsounds Plugin

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users…

PLUGIN Zoomsounds

CVE-2024-13776

HIGH CVSS 8.1 2025-04-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-26

CVE-2024-13777 - Zoomsounds Plugin

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme…

PLUGIN Zoomsounds

CVE-2024-13777

HIGH CVSS 8.1 2025-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-08

CVE-2021-4449 - Zoomsounds Plugin

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.

PLUGIN Zoomsounds

CVE-2021-4449

CRITICAL CVSS 9.8 2024-10-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-39316 - Zoomsounds Plugin

The Zoomsounds plugin

PLUGIN Zoomsounds

CVE-2021-39316

HIGH CVSS 7.5 2021-08-31

Risk Score

Open Full Technical Breakdown