Trinity Audio Vulnerabilities

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.23.3. This makes it possible for authenticated attackers, with Subscriber-level access and ab...

CVSS:

4.3

Affected:

up to 5.23.3

Fixed in:

5.24

Disclosed:

Dec 12, 2025

CVE-2025-67466 on NVD →

[en] Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.

Affected:

up to 5.23.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67466 on NVD →

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to ex...

CVSS:

5.3

Affected:

up to 5.21.0

Fixed in:

5.22.0

Disclosed:

Oct 10, 2025

CVE-2025-9196 on NVD →

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthe...

CVSS:

6.1

Affected:

up to 5.20.2

Fixed in:

5.21.0

Disclosed:

Oct 3, 2025

CVE-2025-9952 on NVD →

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for un...

CVSS:

4.3

Affected:

up to 5.20.2

Fixed in:

5.21.0

Disclosed:

Oct 3, 2025

CVE-2025-9886 on NVD →

[en] Missing Authorization vulnerability in sergiotrinity Trinity Audio allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trinity Audio: from n/a through 5.20.0.

Affected:

up to 5.20.1

Fixed in:

5.20.1

Disclosed:

Jun 6, 2025

CVE-2025-49272 on NVD →

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.20.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.20.0

Fixed in:

5.20.1

Disclosed:

Jun 5, 2025

CVE-2025-49272 on NVD →

Affected:

up to 5.21.0

Fixed in:

5.21.0

CVE-2025-9952 on NVD →

Affected:

up to 5.21.0

Fixed in:

5.21.0

CVE-2025-9886 on NVD →

Affected:

up to 5.22.0

Fixed in:

5.22.0

CVE-2025-9196 on NVD →