← WordPress Vulnerabilities
WordPress security by component

Play.Ht

Play.Ht is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jun 24, 2024; the highest CVE/CNA score is 8.8.

Plugin slug: play-ht

CVE-2024-37233: Play.Ht: A security weakness

Play.Ht is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

PublishedJun 24, 2024
Safe version guidanceSee mitigation notes
Safe version
Jun 24, 2024 CVE-2024-37233
Play.Ht: A security weakness
Play.Ht is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Mar 13, 2024 CVE-2024-1772
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio: Code execution
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio is affected by code execution. Exploitation requires at least contributor-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE8.8
NVDPending
Mar 13, 2024 CVE-2024-0828
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio: A security weakness
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.4
NVD6.3
Mar 13, 2024 CVE-2024-0827
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio: Cross-site request forgery
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD4.3