https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:44:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75966 <p><strong>Affected:</strong> eteubert Podlove Podcast Publisher</p> <p>The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;episode_contributor[..][..][comment]&#39; Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core&#39;s wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.</p> <p><strong>Affected:</strong> eteubert Podlove Podcast Publisher</p> <p>The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;episode_contributor[..][..][comment]&#39; Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core&#39;s wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.</p> https://vulnerability.circl.lu/vuln/cve-2026-75966