Vulnerabilities

TI-2026-65983 CVE-2026-96578 · GHSA-5j3q-4q9j-rwqr

GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

LOW 31

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0025 Published 2026-10-02 No fix listed CWE-79

TI-2025-09352 CVE-2025-10187 · GHSA-9xm3-6gv6-p2cp

GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection

LOW 23

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user suppl…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0041 Published 2025-10-18 No fix listed CWE-89

Vulnerabilities

Filters

GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection