CyberSecBulletin

WavePlayer vulnerabilities

We track 1 vulnerability in WavePlayer products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on November 19, 2025.

1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score

Latest WavePlayer vulnerabilities

  • 9.8 Critical severity

    WavePlayer: Unrestricted Upload of File with Dangerous Type

    CVE-2025-12057WavePlayer

    The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE