Extension WordPress
Vulnérabilités ZoomSounds – WordPress Wave Audio Player with Playlist
Cette page rassemble les failles publiées pour ZoomSounds – WordPress Wave Audio Player with Playlist, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de ZoomSounds – WordPress Wave Audio Player with Playlist
9 fiches
ZoomSounds <= 6.91 – Reflected Cross-Site Scripting
The ZoomSounds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-6.91
Non indiqué
03/06/2025
ZoomSounds <= 6.91 – Unauthenticated PHP Object Injection
The ZoomSounds plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.91 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP…
*-6.91
Non indiqué
20/05/2025
ZoomSounds – WordPress Wave Audio Player with Playlist <= 6.91 – Unauthenticated Arbitrary File Download
The ZoomSounds – WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to…
*-6.91
Non indiqué
07/04/2025
ZoomSounds – WordPress Wave Audio Player with Playlist <= 6.91 – Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
The ZoomSounds – WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action…
*-6.91
Non indiqué
04/04/2025
ZoomSounds <= 6.91 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated…
*-6.91
Non indiqué
04/04/2025
ZoomSounds – WordPress Wave Audio Player with Playlist <= 6.91 – Unauthenticated PHP Object Injection
The ZoomSounds – WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it…
*-6.91
Non indiqué
04/03/2025
ZoomSounds – WordPress Wave Audio Player with Playlist <= 6.45 – Directory Traversal
The Zoomsounds plugin
*-6.45
6.50
30/08/2021
ZoomSounds <= 5.96 – Unauthenticated Arbitrary File Upload
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary…
*-5.96
6.05
24/06/2021
ZoomSounds <= 2.0 – Arbitrary File Upload
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
[*, 3.0)
3.0
01/06/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.