Castos

CVE-2025-66061 Nov 21, 13:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.13.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-66060 Nov 21, 13:15 MEDIUM This Month

Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.13.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-66059 Nov 21, 13:15 MEDIUM This Month

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2025-62882 Oct 27, 02:15 MEDIUM This Month

Authenticated low-privilege users of the Seriously Simple Podcasting WordPress plugin (version ≤ 3.13.0) can bypass access controls to modify podcast content. This missing authorization flaw (CWE-862) results from incorrectly configured access control security levels. Exploitation has not been observed in the wild (EPSS 0.03%).

CVE-2025-49923 Oct 22, 15:15 MEDIUM This Month

DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.

CVE-2025-46261 Apr 24, 16:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting allows Stored XSS.9.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-9667 Nov 05, 09:15 MEDIUM PATCH This Month

The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-8738 Sep 24, 02:15 MEDIUM PATCH This Month

The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-3751 Jul 13, 06:15 MEDIUM POC This Month

The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-25599 Mar 28, 07:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-45001 Nov 06, 09:15 HIGH This Week

A vulnerability in Craig Hewitt Seriously Simple Stats seriously-simple-stats.5.0. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-45005 Oct 17, 10:15 MEDIUM This Month

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-40132 Sep 23, 19:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.