Description

Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:35.073Z",
  "pubdate": "2026-08-20T12:16:35.073Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Podlove Podcast Publisher plugin, specifically affecting versions 4.5.4 and prior. This security flaw enables remote attackers to inject malicious scripts, typically written in JavaScript, into vulnerable input fields or parameters processed by the application. Because the application fails to adequately sanitize or encode user-supplied input before rendering it in the victim's browser, the injected payload executes within the context of the user's session.\nThe primary impact of this vulnerability includes unauthorized script execution in the context of the victim's browser session. If successfully exploited against privileged users, such as administrators, attackers could potentially manipulate content, steal sensitive session cookies, or perform actions on behalf of the compromised user. The vulnerability is accessible over the network without requiring any prior authentication, lowering the barrier to entry for malicious actors targeting installations of Podlove Podcast Publisher running vulnerable version constraints.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated Cross-Site Scripting (XSS) flaw residing within the Podlove Podcast Publisher plugin for versions <= 4.5.4. The root cause stems from insufficient input sanitization and a lack of proper output contextual encoding on parameters processed by the web application. When untrusted user input is handled by the vulnerable component and subsequently reflected back into the Hypertext Markup Language (HTML) response, the browser interprets the input as executable code rather than plain text.\nExploitation of this vulnerability requires network connectivity to the targeted WordPress instance running the affected Podlove Podcast Publisher versions. No authentication or elevated privileges are required, allowing anonymous network attackers to initiate the attack flow. The attack vector typically involves crafting a malicious Uniform Resource Locator (URL) or submitting specially crafted HTTP requests containing JavaScript payloads designed to bypass weak filtering mechanisms.\nUpon interaction by a victim with the malicious payload link or via automated execution contexts, the browser processes the injected script within the security context of the vulnerable site. The payload behavior can range from defacement and redirection to the extraction of sensitive session tokens, depending on the constraints of the Document Object Model (DOM) and browser security policies. Post-exploitation impact heavily relies on the privilege level of the targeted user interacting with the payload, potentially leading to full administrative compromise if an authenticated administrator views the malicious content."
}