WordPress plugin
ZoomSounds - WordPress Wave Audio Player with Playlist security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High4
- Medium2
- Low0
All ZoomSounds - WordPress Wave Audio Player with Playlist vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated PHP Object Injection ≤6.91No patch available | CVE-2025-47568 | |
| High7.5 | WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download ≤6.91No patch available | CVE-2025-3431 | |
| High8.1 | WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation ≤6.91No patch available | CVE-2024-13776 | |
| High8.1 | WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection ≤6.91No patch available | CVE-2024-13777 | |
| High7.5 | WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal ≤6.45Update to 6.50 | CVE-2021-39316 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤5.96Update to 6.05 | CVE-2021-4449 | |
| Critical9.8 | Arbitrary File Upload <3.0Update to 3.0 | CVE-2015-9471 |
- Critical9.8Unauthenticated PHP Object Injection
≤6.91No patch available
- High7.5WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download
≤6.91No patch available
- High8.1WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
≤6.91No patch available
- High8.1WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
≤6.91No patch available
- High7.5WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal
≤6.45Update to 6.50
- Critical9.8Unauthenticated Arbitrary File Upload
≤5.96Update to 6.05
- Critical9.8Arbitrary File Upload
<3.0Update to 3.0
ZoomSounds - WordPress Wave Audio Player with Playlist: common questions
Does ZoomSounds - WordPress Wave Audio Player with Playlist have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in ZoomSounds - WordPress Wave Audio Player with Playlist: 3 critical, 4 high, 2 medium. At least one is not fixed in the latest version.
How do I check which version of ZoomSounds - WordPress Wave Audio Player with Playlist I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ZoomSounds - WordPress Wave Audio Player with Playlist vulnerability?
CVE-2025-47566, published Jun 3, 2025: ZoomSounds <= 6.91 - Reflected Cross-Site Scripting. Severity: Medium (CVSS 6.1).
Is any ZoomSounds - WordPress Wave Audio Player with Playlist vulnerability listed in CISA KEV?
No. None of the known ZoomSounds - WordPress Wave Audio Player with Playlist vulnerabilities is currently listed in the CISA KEV catalog.