Podcast Channels < 0.28 - Cross-Site Scripting

The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability. id: CVE-2014-4544 info: name: Podcast Channels 0.28 - Cross-Site Scripting author: daffainfo severity: medium description: The Podcast Channels WordPress plugin was...

Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload

Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlovehandlecachefiles function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

CVE-2026-97319 PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-97319

The PowerPress Podcasting plugin by Blubrry for WordPress, in versions prior to 11.17.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitize and escape a block attribute before it is outputted on a page. This flaw allows users with the contributo...

CVE-2026-13001

CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critical | Unauthenticated Arbitrary File Upload leading to Remote Code Execution Overview Critical vulnerability in the Podlove Podcast Publisher WordPress plugin versions up to and including 4.5.1 that allows unauthenticated attackers to upload...

CVE-2025-10147

CVE-2025-10147 Podlove Podcast Publisher = 4.2.6 - Subida Arbitraria de Archivos no Autenticada El plugin Podlove Podcast Publisher para WordPress es vulnerable a subidas arbitrarias de archivos debido a la falta de validación del tipo de archivo en la función 'moveasoriginalfile' en todas las...

CVE-2026-94682

The Podcast Importer SecondLine plugin for WordPress, in versions

EUVD-2026-85486

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Podcast Importer SecondLine versions = 1.5.6...

CVE-2026-94682: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

WordPress Podlove Podcast Publisher plugin <= 4.5.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by an unknown individual in WordPress Plugin Podlove Podcast Publisher versions = 4.5.1...

CVE-2026-75966

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75966 Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75966

The Podlove Podcast Publisher WordPress plugin (all versions ≤ 4.5.5) is vulnerable to Stored Cross-Site Scripting via the episode_contributor[..][..][comment] parameter. The root cause is insufficient input sanitization and output escaping: the contributor comment is stored in a plugin-managed c...

EUVD-2026-74609

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75966 Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75966: Improper Neutralization of Input During Web Page Generation

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-88797

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode contributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...