ZoomSounds - WordPress Wave Audio Player with Playlist vulnerabilities

3 known vulnerabilities in ZoomSounds - WordPress Wave Audio Player with Playlist from ZoomIt. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ZoomSounds - WordPress Wave Audio Player with…: External Control of File Name or Path

  CVE-2025-3431Apr 8, 2025ZoomIt

  The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the co

• 8.1 High severity

  ZoomSounds - WordPress Wave Audio Player with…: Missing Authorization

  CVE-2024-13776Apr 5, 2025ZoomIt

  The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions u

• 9.8 Critical severity

  ZoomSounds - WordPress Wave Audio Player with…: Deserialization of Untrusted Data

  CVE-2024-13777Mar 5, 2025ZoomIt

  The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unaut