Easy Waveform Player

Easy Waveform Player has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Easy Waveform Player has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Peter Thaleikis. Easy Waveform Player is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Easy Waveform Player vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-7963

Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv1.2.3

Easy Waveform Player

tymotey

Author

tymotey

0.0(0)
0/100
Last Updated
2026-08-31 (12d ago)
Active Installs
100+
Downloads
6,570
Requires WP
5.0+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2020-10-13 (6y ago)

SSL certificate is REQUIRED for the plugin to work! Easy Waveform Player allows you to add visual waveform, generated on the fly, for an audio file. Loads audio on request only. If multiple players are showed they will not over load all the audio at once. Autostop other Easy Waveform Players if they are playing. How to use: 1) Use the block from the editor you have installed(intergrated in: Gutenberb, Elementor, WPBakery Visual Builder, DIVI) 2) Run code programatically. Code example: global $easywaveformplayer; echo $easywaveformplayer->easywaveformplayer( array( 'audio' => 'https://link.to/audio.mp3', ) ); 3) Write manual shortcode using examples below Examples: Load audio by libray id: [easywaveformplayer audio="6"] Load audio by URL: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3"] Autoplay(this requires that user allow permission to autoplay for your page): [easywaveformplayer audio="6" autoplay="1"] Add title: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" title="This is a title"] Animated appearence of timeline: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" animated="true"] Wave design changes: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" timeline_wave_color="#FF0000" timeline_progress_color="#000000"] Colored timelime background(including gradient): [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" timeline_background_color="linear-gradient(90deg, rgba(2,0,36,1) 0%, rgba(9,9,121,1) 35%, rgba(0,212,255,1) 100%)"] Minimum size and adding different size then default: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" min="true" mini_size="100"] Minimum size with progress indicator: [easywaveformplayer audio="https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3" min="true" show_progress="true"] Parameters and default values: id -> ” can be any value containing letters, numbers, _ OR – Value Added will be concatenated with: “ewfplayer_”. Eg: ewfplayer_mainplayer always_play -> 0 (0 – it will stop when other player start playing, 1 – it will continue playing when other start playing) autoplay -> 0 (accepted 0 or 1 values) animated -> false (accepted true or false values) min -> false (accepted true or false values) show_progress -> false (accepted true or false values) player_width -> 100% (any css width values) player_position -> left (left, center, right) player_background_color -> transparent (or other CSS color) mini_size -> 60 (in px) mini_border_size -> 2 (in px) mini_border_color -> #000000 (transparent or other CSS color) progress_circle_thickness -> 4 (in px) progress_circle_color -> #FF0000 (transparent or other CSS color) controller_size -> 40 (in px) controller_color -> #000000 (transparent or other CSS color) timeline_background_color -> transparent (in px) timeline_wave_color -> #999999 (transparent or other CSS color) timeline_progress_color -> #555555 (transparent or other CSS color) timeline_cursor_width -> 1 (in px) timeline_cursor_color -> #333333 (transparent or other CSS color) timeline_height -> 128 (in px) timeline_bar_gap -> 0 (any number, starting from 0) timeline_bar_width -> 0 (any number, starting from 0) timeline_bar_radius -> 0 (any number, starting from 0) Built using library: https://wavesurfer-js.org/ SSL certificate is REQUIRED for the plugin to work!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C