Is Podlove Podcast Publisher safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (4.5.8). As of 2026-11-04. 28 issues are on record for older versions; version 4.5.7 or newer fixes all of them that state a fix. Keep Podlove Podcast Publisher on the latest version (4.5.8) and remove it if you do not use it.

Which versions of Podlove Podcast Publisher are vulnerable?

Known issues on record (newest first): Stored cross-site scripting (XSS) (4.5.6 and older, fixed in 4.5.7); Stored cross-site scripting (XSS) (4.5.5 and older, fixed in 4.5.6); Cross-site scripting (XSS) (4.5.4 and older, fixed in 4.5.5); Arbitrary file deletion (4.5.3 and older, fixed in 4.5.4); Cross-site request forgery (CSRF) (older than 4.5.3, fixed in 4.5.3); Arbitrary file upload (4.5.1 and older, fixed in 4.5.2). The full list with sources is on this page.

What is the latest version of Podlove Podcast Publisher?

4.5.8, according to wordpress.org (last updated 2026-10-14). It has 3,000+ active installs.

What should I do if my Podlove Podcast Publisher is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update podlove-podcasting-plugin-for-wordpress). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · podlove-podcasting-plugin-for-wordpress · data as of 2026-11-04

Is Podlove Podcast Publisher safe? Known vulnerabilities and latest version

Latest version: 4.5.8
Last updated: 2026-10-14
Active installs: 3,000+
Known issues on record: 28
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 8.0+

The one and only next generation podcast publishing system. Seriously. It's magical and sparkles a lot. — by Eric Teubert

What to do

Update to the latest version (4.5.8). Anything older than 4.5.7 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get podlove-podcasting-plugin-for-wordpress --field=version shows what you run; wp plugin update podlove-podcasting-plugin-for-wordpress updates it.

Check your version

Known vulnerabilities

28 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 7.2 CVE-2026-93775 · published 2026-10-10

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.6 and older)

Affected: 4.5.6 and older
Fixed in: 4.5.7 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the status_string field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log before any authentication key validation is performed.

NVD CVE-2026-93775 Wordfence advisory Code change (fix)github.com Plugin source

medium 6.4 CVE-2026-75966 · published 2026-09-09

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.5 and older)

Affected: 4.5.5 and older
Fixed in: 4.5.6 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.

NVD CVE-2026-75966 Wordfence advisory Code change (fix)Plugin source

high 7.1 CVE-2026-66615 · published 2026-08-20

Cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.4 and older)

Affected: 4.5.4 and older
Fixed in: 4.5.5
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

NVD CVE-2026-66615 Patchstack advisory

high 8.8 CVE-2026-16099 · published 2026-08-16

Arbitrary file deletion in Podlove Podcast Publisher (4.5.3 and older)

Affected: 4.5.3 and older
Fixed in: 4.5.4 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization.

NVD CVE-2026-16099 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2026-13729 · published 2026-08-01

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 4.5.3)

Affected: older than 4.5.3
Fixed in: 4.5.3
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

NVD CVE-2026-13729 WPScan advisory

critical 9.8 CVE-2026-13001 · published 2026-07-14

Arbitrary file upload in Podlove Podcast Publisher (4.5.1 and older)

Affected: 4.5.1 and older
Fixed in: 4.5.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

NVD CVE-2026-13001 Wordfence advisory Code change (fix)github.com Plugin source

medium 6.5 CVE-2026-32448 · published 2026-03-13

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.3.3 and older)

Affected: 4.3.3 and older
Fixed in: 4.3.4
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.

NVD CVE-2026-32448 Patchstack advisory

critical 9.8 CVE-2025-10147 · published 2025-09-23

Arbitrary file upload in Podlove Podcast Publisher (4.2.6 and older)

Affected: 4.2.6 and older
Fixed in: 4.2.7 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

NVD CVE-2025-10147 Wordfence advisory Code change (fix)Plugin source

medium 4.7 CVE-2025-58204 · published 2025-08-27

Open redirect in Podlove Podcast Publisher (4.2.5 and older)

Affected: 4.2.5 and older
Fixed in: 4.2.6
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phishing.This issue affects Podlove Podcast Publisher: from n/a through <= 4.2.5.

NVD CVE-2025-58204 Patchstack advisory

medium 4.8 CVE-2024-13730 · published 2025-05-15

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (older than 4.2.1)

Affected: older than 4.2.1
Fixed in: 4.2.1
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

NVD CVE-2024-13730 WPScan advisory

medium 4.8 CVE-2024-13729 · published 2025-05-15

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (older than 4.1.24)

Affected: older than 4.1.24
Fixed in: 4.1.24
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

NVD CVE-2024-13729 WPScan advisory

medium 4.3 CVE-2025-1383 · published 2025-03-06

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (4.2.2 and older)

Affected: 4.2.2 and older
Fixed in: 4.2.3 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2025-1383 Wordfence advisory Code change (fix)wordpress.org Plugin source

medium 4.0 CVE-2025-0554 · published 2025-01-18

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.1.25 and older)

Affected: 4.1.25 and older
Fixed in: 4.2.0 *
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

NVD CVE-2025-0554 Wordfence advisory Code change (fix)

high 7.2 CVE-2024-52393 · published 2024-11-14

PHP object injection in Podlove Podcast Publisher (4.1.15 and older)

Affected: 4.1.15 and older
Fixed in: 4.1.17
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.

NVD CVE-2024-52393 Patchstack advisory

high 8.8 CVE-2024-43984 · published 2024-10-31

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (4.1.13 and older)

Affected: 4.1.13 and older
Fixed in: 4.1.14
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.

NVD CVE-2024-43984 Patchstack advisory

medium 5.4 CVE-2024-43983 · published 2024-09-18

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.1.13 and older)

Affected: 4.1.13 and older
Fixed in: 4.1.14
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.

NVD CVE-2024-43983 Patchstack advisory

high 8.8 CVE-2024-32143 · published 2024-06-11

Missing authorization check in Podlove Podcast Publisher (4.1.0 and older)

Affected: 4.1.0 and older
Fixed in: 4.1.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.

NVD CVE-2024-32143 Patchstack advisory

medium 4.3 CVE-2024-32712 · published 2024-05-14

Missing authorization check in Podlove Podcast Publisher (4.0.14 and older)

Affected: 4.0.14 and older
Fixed in: 4.0.15
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.

NVD CVE-2024-32712 Patchstack advisory

medium 5.4 CVE-2024-32812 · published 2024-04-24

Server-side request forgery (SSRF) in Podlove Podcast Publisher (4.0.11 and older)

Affected: 4.0.11 and older
Fixed in: 4.0.12
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.

NVD CVE-2024-32812 Patchstack advisory

high 8.8 CVE-2024-32139 · published 2024-04-15

SQL injection in Podlove Podcast Publisher (4.0.12 and older)

Affected: 4.0.12 and older
Fixed in: 4.0.14
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12.

NVD CVE-2024-32139 Patchstack advisory

medium 6.1 CVE-2024-29915 · published 2024-03-27

Reflected cross-site scripting (XSS) in Podlove Podcast Publisher (4.0.9 and older)

Affected: 4.0.9 and older
Fixed in: 4.0.10
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Reflected XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.0.9.

NVD CVE-2024-29915 Patchstack advisory

medium 5.3 CVE-2024-1110 · published 2024-02-07

Missing authorization check in Podlove Podcast Publisher (4.0.11 and older)

Affected: 4.0.11 and older
Fixed in: 4.0.15 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.

NVD CVE-2024-1110 Wordfence advisory Code change (fix)github.com

medium 5.3 CVE-2024-1109 · published 2024-02-07

Missing authorization check in Podlove Podcast Publisher (4.0.11 and older)

Affected: 4.0.11 and older
Fixed in: 4.0.15 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.

NVD CVE-2024-1109 Wordfence advisory Code change (fix)github.com

high 8.8 CVE-2023-25472 · published 2023-05-23

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (3.8.3 and older)

Affected: 3.8.3 and older
Fixed in: 3.8.4
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.

NVD CVE-2023-25472 Patchstack advisory

medium 4.8 CVE-2023-25046 · published 2023-04-07

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (3.8.2 and older)

Affected: 3.8.2 and older
Fixed in: 3.8.3
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.2 versions.

NVD CVE-2023-25046 Patchstack advisory

critical 9.8 CVE-2021-24666 · published 2021-09-27

SQL injection in Podlove Podcast Publisher (older than 3.5.6)

Affected: older than 3.5.6
Fixed in: 3.5.6
Access needed (per CVSS): No login needed
Range from: advisory text · score by NVD

Details from the advisory

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.

NVD CVE-2021-24666 WPScan advisory github.com

medium 6.1 CVE-2016-10941 · published 2019-09-13

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 2.3.16)

Affected: older than 2.3.16
Fixed in: 2.3.16
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.

NVD CVE-2016-10941 wordpress.org blog.ripstech.com github.com

critical 9.8 CVE-2016-10942 · published 2019-09-13

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 2.3.16)

Affected: older than 2.3.16
Fixed in: 2.3.16
Access needed (per CVSS): No login needed
Range from: advisory text · score by NVD

Details from the advisory

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.

NVD CVE-2016-10942 wordpress.org blog.ripstech.com github.com

Recent activity

2026-10-14 — latest release on wordpress.org (4.5.8).
2026-10-10 — Stored cross-site scripting (XSS) disclosed (CVE-2026-93775), fixed in 4.5.7.
2026-09-09 — Stored cross-site scripting (XSS) disclosed (CVE-2026-75966), fixed in 4.5.6.
2026-08-20 — Cross-site scripting (XSS) disclosed (CVE-2026-66615), fixed in 4.5.5.

Free. We check the CVE feeds every day and email you only when a new issue for Podlove Podcast Publisher (podlove-podcasting-plugin-for-wordpress) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (10) · Cross-site request forgery (CSRF) (6) · Missing authorization (4) · Arbitrary file upload (2) · SQL injection (2) · Arbitrary file deletion (1) · Open redirect (1) · PHP object injection (1) · Server-side request forgery (SSRF) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/podlove-podcasting-plugin-for-wordpress"><img src="https://laskyr.com/plugins/podlove-podcasting-plugin-for-wordpress/badge.svg" alt="Podlove Podcast Publisher vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Podlove Podcast Publisher safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (4.5.8)

What to do

Check your version

Known vulnerabilities

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.6 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.5 and older)

Cross-site scripting (XSS) in Podlove Podcast Publisher (4.5.4 and older)

Arbitrary file deletion in Podlove Podcast Publisher (4.5.3 and older)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 4.5.3)

Arbitrary file upload in Podlove Podcast Publisher (4.5.1 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.3.3 and older)

Arbitrary file upload in Podlove Podcast Publisher (4.2.6 and older)

Open redirect in Podlove Podcast Publisher (4.2.5 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (older than 4.2.1)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (older than 4.1.24)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (4.2.2 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.1.25 and older)

PHP object injection in Podlove Podcast Publisher (4.1.15 and older)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (4.1.13 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (4.1.13 and older)

Missing authorization check in Podlove Podcast Publisher (4.1.0 and older)

Missing authorization check in Podlove Podcast Publisher (4.0.14 and older)

Server-side request forgery (SSRF) in Podlove Podcast Publisher (4.0.11 and older)

SQL injection in Podlove Podcast Publisher (4.0.12 and older)

Reflected cross-site scripting (XSS) in Podlove Podcast Publisher (4.0.9 and older)

Missing authorization check in Podlove Podcast Publisher (4.0.11 and older)

Missing authorization check in Podlove Podcast Publisher (4.0.11 and older)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (3.8.3 and older)

Stored cross-site scripting (XSS) in Podlove Podcast Publisher (3.8.2 and older)

SQL injection in Podlove Podcast Publisher (older than 3.5.6)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 2.3.16)

Cross-site request forgery (CSRF) in Podlove Podcast Publisher (older than 2.3.16)

Recent activity

Get an email when Podlove Podcast Publisher has a new vulnerability

Browse vulnerabilities

Where this data comes from