Stored Cross-Site Scripting in Podlove Podcast Publisher Plugin for WordPress

CVE-2026-93775

What is CVE-2026-93775?

The Podlove Podcast Publisher plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to improper input validation and inadequate output sanitization, particularly within the Auphonic Webhook feature. This flaw allows unauthenticated attackers to inject malicious scripts into web pages, which will run when users visit those pages. The vulnerability is triggered by sending a POST request to the Auphonic webhook endpoint with a specific field, 'status_string', that does not match the expected value of 'Done'. As a result, the plugin may log the entire raw POST superglobal without verifying an authentication key, creating a security risk for websites utilizing this plugin.

References