Podcast Generator 3.1 allows an authenticated attacker to persistently inject malicious scripts by submitting unfiltered JavaScript code in the long_description parameter. When other users view the episode details, the injected script executes in their browsers, allowing arbitrary JavaScript execution. This flaw is classified as CWE‑79. The impact attacks confidentiality and integrity of user data but does not provide remote code execution or system privilege escalation beyond the attacker’s credentials.

The affected product is Podcast Generator 3.1, distributed by Podcastgenerator. All installations that have not applied an official patch or upgrade are vulnerable; the flaw is limited to the episode long_description parameter in the web interface.

The CVSS score of 5.1 indicates moderate risk. The EPSS score of 0.00034 (0.034%) indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying no documented widespread attacks. Attackers must be authenticated to submit or edit an episode, so the threat surface is somewhat constrained. However, once an episode with malicious content is viewed, the victim’s browser executes arbitrary JavaScript, which could allow an attacker to run additional malicious scripts.