EUVD-2026-63299
GHSA-85cf-gxpr-2gj4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS with no auth requirement; scope change captures browser-context impact; A:N assessed as XSS does not directly cause availability loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
AnalysisAI
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication from the attacker - the CVSS PR:N metric confirms the vulnerable plugin endpoint is reachable without logging into WordPress. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.1 score reflects a moderately high base risk driven primarily by the zero-authentication attack vector (AV:N/PR:N) and scope change (S:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Podlove Podcast Publisher plugin to a version above 4.5.4 via the WordPress plugin update mechanism or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Podlove Podcast Publisher and determine the installed version; immediately disable the plugin if running version 4.5.4 or lower, and audit recent access logs for suspicious administrative activity or unauthorized actions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Podlove Podcast Publisher
View allArbitrary file upload in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.1) allows remote attac
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by def
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Po
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPr
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which cou
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which co
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.1.13. Rated h
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.1.0. Rated high severity (CVSS 8.8), this vulne
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions. Rated hig
CSRF in Podlove Podcast Publisher WordPress plugin (all versions before 4.5.3) allows unauthenticated remote attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today