Seriously Simple Podcasting EUVD-2026-105038

Requires an authenticated WordPress account with at least low-privilege posting capability (PR:L) able to submit podcast content through the Seriously Simple Podcasting plugin, and requires a second user (typically an administrator or editor) to subsequently view the page containing the stored payload (UI:R) for the script to execute. Exploitation is limited by: the need for valid authenticated access to a posting/contributor role, dependence on victim interaction (the payload is passive until viewed), and applicability only to sites running Seriously Simple Podcasting version 3.17.0 or earlier. Sites that restrict content-authoring roles to trusted users are substantially less exposed.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) in the Castos Seriously Simple Podcasting WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable but authenticated attack (PR:L) that additionally requires victim interaction (UI:R) and crosses a security scope boundary (S:C) - characteristics typical of stored XSS where a lower-privileged user injects a payload that later executes in a higher-privileged user's browser. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so exploitation probability cannot be quantified; the signals that ARE present (PR:L + UI:R) point to this being a dependent, not fully-automatable, attack rather than an unauthenticated mass-exploitation threat. There is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a real but second-tier priority - patch in normal cycles, prioritize on sites with untrusted contributor/author accounts, rather than an emergency given the authentication and interaction prerequisites and the low (C:L/I:L/A:L) technical impact.

A user with a low-privileged authenticated role (e.g., contributor or author) submits podcast content containing a malicious script payload that is stored by the plugin without proper neutralization. When an administrator or other user later views the affected page in wp-admin or the front end, the script executes in their browser session, potentially hijacking the session or performing actions on their behalf. No public POC is identified, and successful exploitation depends on the victim viewing the injected content (UI:R).