EUVD-2026-13994
GHSA-fm6h-hmg3-46c3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in all versions up to, and including, 0.3.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'color', 'podcast_id', and 'podcast_slug'. These attributes are directly concatenated into inline JavaScript within single-quoted string arguments without any escaping or sanitization, allowing an attacker to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The fyyd podcast shortcodes plugin for WordPress contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 0.3.1, where shortcode attributes (color, podcast_id, podcast_slug) are improperly concatenated into inline JavaScript without sanitization or escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes for all users viewing affected pages, allowing session hijacking, credential theft, or malware distribution. The CVSS 6.4 score reflects moderate risk with network-accessible attack vector and low complexity, though exploitation requires prior authentication.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, a classic Stored XSS), where user-supplied shortcode attributes are directly concatenated into JavaScript string literals within HTML inline event handlers without proper escaping or sanitization. The affected product is the fyyd podcast shortcodes plugin for WordPress (CPE: cpe:2.3:a:cbednarek:fyyd_podcast_shortcodes:*:*:*:*:*:*:*:*), developed by cbednarek. The vulnerability exists across multiple handler functions that process [fyyd-podcast], [fyyd-episode], and [fyyd] shortcodes. The root cause is the failure to escape single-quote characters and JavaScript-special characters in attributes before embedding them in inline JavaScript contexts, allowing attackers to break out of the intended string scope and inject arbitrary code.
RemediationAI
If a patched version is available from the plugin developer, upgrade fyyd podcast shortcodes to the latest version immediately via the WordPress Plugins dashboard. If no patch exists or the plugin is abandoned, disable and remove the plugin entirely, then replace its functionality with alternative podcast shortcode plugins from trusted developers with active maintenance. As a temporary control if removal is infeasible, restrict Contributor-level account creation and audit existing Contributors for suspicious posts containing malicious shortcode attributes. Additionally, implement WordPress security hardening via security plugins (Wordfence, Sucuri) to detect and block XSS payloads, and enable Content Security Policy (CSP) headers to mitigate inline script execution. Monitor the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9d57ae-b238-43db-8eee-ccab499b1cbc?source=cve) and WordPress plugin repository for updates.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today