CVE-2026-75966
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- EPSS probability
- 0.26%
- CWE
- CWE-79
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- eteubert Podlove Podcast Publisher
Weakness type
Related vulnerabilities
- CVE-2026-18147 — Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
- CVE-2026-86772 — Snipe-IT 8.6.3 Stored XSS via Department Names
- CVE-2026-87814 — SiYuan before v3.8.2 Stored XSS via Asset Preview
- CVE-2026-87813 — SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
- CVE-2026-87812 — SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- CVE-2026-87811 — SiYuan before v3.8.2 Stored XSS via notebook template paths
- CVE-2025-3271 — DOM-based XSS vulnerability in OpenText™ Documentum Webtop
- CVE-2026-14989 — Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter