Podlove Podcast Publisher CVE-2026-93775

Exploitation requires the Podlove Podcast Publisher plugin (version ≤ 4.5.6) with the Auphonic module active so its webhook endpoint is network-reachable. The injection itself needs NO authentication, no authkey, and no valid configuration - the only requirement is a POST to the Auphonic webhook whose status_string field is any value other than the literal 'Done', which causes the full raw POST superglobal to be stored in the plugin log before the authkey validation runs. The key LIMITING factor is that the stored payload only executes when a logged-in administrator subsequently opens the plugin's logging/Support page in wp-admin; without an admin viewing the log, no code executes. Impact is confined to the admin's authenticated browser context (reflected in the scope change), and is low on confidentiality and integrity with no availability impact.

This is a genuine but conditional risk, not a drop-everything emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 by Wordfence) models a network-reachable, unauthenticated, low-complexity injection with a scope change, which is consistent with the source evidence: the Auphonic webhook in auphonic.php writes the full raw $_POST into the plugin log BEFORE any authkey validation whenever status_string is not 'Done', and logging.php then renders that stored context unescaped on the Support page. However, the Wordfence UI:N is debatable - this is STORED XSS whose payload only fires when a logged-in administrator opens the plugin's log/Support page, which is arguably passive user interaction (UI:R / CVSS4 UI:P), so the real-world trigger is not fully attacker-controlled. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent rather than negative: status is 'no public exploit identified at time of analysis.' Net: a real, patch-worthy flaw (unauthenticated injection into an admin-viewed log) but the impact is limited to C:L/I:L in an admin's browser context and gated on an admin viewing the log, making it a moderate priority rather than a wormable critical.

An unauthenticated attacker sends a single crafted POST request to the plugin's public Auphonic webhook endpoint with a status_string value other than 'Done' and a JavaScript payload embedded in the POST body. Because the plugin logs the entire raw $_POST before validating the authkey, the payload is persisted to the plugin log; it then executes in the browser of any administrator who later opens the Podlove Support/log page. No public exploit code was identified in the provided data, though the patch commit publicly reveals the exact vulnerable code path.