The Trinity Audio – Text to Speech AI audio player plugin for WordPress contains a reflected XSS flaw (CWE‑79) caused by inadequate sanitization of the “range‑date” URL parameter. When the parameter is echoed back without proper encoding, an attacker can embed malicious JavaScript that executes in the victim’s browser whenever a user follows a crafted link. This client‑side code execution can be used for phishing, defacement, or credential theft, and the vulnerability is exploitable by unauthenticated users.

WordPress sites that have installed the Trinity Audio plugin from the vendor sergiotrinity, specifically versions up to and including 5.20.2, are affected. The flaw exists in all releases of the plugin in that range, independent of the WordPress core version or other plugins.

The CVSS base score of 6.1 indicates a moderate severity reflected XSS. The EPSS score of less than 1% reflects a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trivially create a malicious link containing a crafted “range‑date” value, luring a victim to click it; the injected script runs under the site’s domain, granting the attacker control of the victim’s session or the ability to exfiltrate data.