{"id":"CVE-2026-75966","aliases":["EUVD-2026-74609","GHSA-p45h-8jm6-4vhq"],"status":"published","title":"Podlove Podcast Publisher \u003c= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter","description":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0045,"percentile":0.39503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-09T03:28:49Z","modified":"2026-09-09T17:17:41Z","products":[{"vendor":"eric teubert","product":"podlove podcast publisher"},{"vendor":"eteubert","product":"podlove podcast publisher"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9253bc-feee-422f-aafb-1630f2d1ad2e?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.4/lib/modules/contributors/contributors.php#L490"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.5/lib/modules/contributors/templates/contributor-table.twig#L59"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.5/lib/modules/contributors/contributors.php#L490"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.5/lib/modules/contributors/contributors.php#L25"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.5/lib/template/twig_filter.php#L139"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.4/lib/modules/contributors/templates/contributor-table.twig#L59"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.4/lib/modules/contributors/contributors.php#L25"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.4/lib/template/twig_filter.php#L139"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3671120%40podlove-podcasting-plugin-for-wordpress\u0026new=3671120%40podlove-podcasting-plugin-for-wordpress"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75966"},{"url":"https://github.com/advisories/GHSA-p45h-8jm6-4vhq"}],"sources":{"cve":[{"id":"CVE-2026-75966","title":"Podlove Podcast Publisher \u003c= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter","description":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.","status":"published","published":"2026-09-09T03:28:49.209Z","modified":"2026-09-09T16:03:16.188Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-74609","description":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.","status":"published","published":"2026-09-09T03:28:49Z","modified":"2026-09-09T16:03:16Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:26.437971Z"}],"ghsa":[{"id":"GHSA-p45h-8jm6-4vhq","title":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting...","description":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.","status":"published","published":"2026-09-09T06:31:37Z","modified":"2026-09-09T06:31:41Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:11:37.523128Z"}],"nvd":[{"id":"CVE-2026-75966","description":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.","status":"published","published":"2026-09-09T04:19:55.697Z","modified":"2026-09-09T17:17:41.07Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:45.612639Z"}]}}